CVE-2024-35886

一、漏洞信息
 漏洞编号：[CVE-2024-35886](https://nvd.nist.gov/vuln/detail/CVE-2024-35886)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.0,6.1.14,6.1.19,6.1.5,6.1.6,6.1.8,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：0.0 None
  Vector：CVSS：3.0/
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:ipv6: Fix infinite recursion in fib6_dump_done().syzkaller reported infinite recursive calls of fib6_dump_done() duringnetlink socket destruction.  [1]From the log, syzkaller sent an AF_UNSPEC RTM_GETROUTE message, and thenthe response was generated.  The following recvmmsg() resumed the dumpfor IPv6, but the first call of inet6_dump_fib() failed at kzalloc() dueto the fault injection.  [0]  12:01:34 executing program 3:  r0 = socket$nl_route(0x10, 0x3, 0x0)  sendmsg$nl_route(r0, ... snip ...)  recvmmsg(r0, ... snip ...) (fail_nth: 8)Here, fib6_dump_done() was set to nlk_sk(sk)->cb.done, and the next callof inet6_dump_fib() set it to nlk_sk(sk)->cb.args[3].  syzkaller stoppedreceiving the response halfway through, and finally netlink_sock_destruct()called nlk_sk(sk)->cb.done().fib6_dump_done() calls fib6_dump_end() and nlk_sk(sk)->cb.done() if itis still not NULL.  fib6_dump_end() rewrites nlk_sk(sk)->cb.done() bynlk_sk(sk)->cb.args[3], but it has the same function, not NULL, callingitself recursively and hitting the stack guard page.To avoid the issue, let s set the destructor after kzalloc().[0]:FAULT_INJECTION: forcing a failure.name failslab, interval 1, probability 0, space 0, times 0CPU: 1 PID: 432110 Comm: syz-executor.3 Not tainted 6.8.0-12821-g537c2e91d354-dirty #11Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014Call Trace: <TASK> dump_stack_lvl (lib/dump_stack.c:117) should_fail_ex (lib/fault-inject.c:52 lib/fault-inject.c:153) should_failslab (mm/slub.c:3733) kmalloc_trace (mm/slub.c:3748 mm/slub.c:3827 mm/slub.c:3992) inet6_dump_fib (./include/linux/slab.h:628 ./include/linux/slab.h:749 net/ipv6/ip6_fib.c:662) rtnl_dump_all (net/core/rtnetlink.c:4029) netlink_dump (net/netlink/af_netlink.c:2269) netlink_recvmsg (net/netlink/af_netlink.c:1988) ____sys_recvmsg (net/socket.c:1046 net/socket.c:2801) ___sys_recvmsg (net/socket.c:2846) do_recvmmsg (net/socket.c:2943) __x64_sys_recvmmsg (net/socket.c:3041 net/socket.c:3034 net/socket.c:3034)[1]:BUG: TASK stack guard page was hit at 00000000f2fa9af1 (stack is 00000000b7912430..000000009a436beb)stack guard page: 0000 [#1] PREEMPT SMP KASANCPU: 1 PID: 223719 Comm: kworker/1:3 Not tainted 6.8.0-12821-g537c2e91d354-dirty #11Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014Workqueue: events netlink_sock_destruct_workRIP: 0010:fib6_dump_done (net/ipv6/ip6_fib.c:570)Code: 3c 24 e8 f3 e9 51 fd e9 28 fd ff ff 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 41 57 41 56 41 55 41 54 55 48 89 fd <53> 48 8d 5d 60 e8 b6 4d 07 fd 48 89 da 48 b8 00 00 00 00 00 fc ffRSP: 0018:ffffc9000d980000 EFLAGS: 00010293RAX: 0000000000000000 RBX: ffffffff84405990 RCX: ffffffff844059d3RDX: ffff8881028e0000 RSI: ffffffff84405ac2 RDI: ffff88810c02f358RBP: ffff88810c02f358 R08: 0000000000000007 R09: 0000000000000000R10: 0000000000000000 R11: 0000000000000224 R12: 0000000000000000R13: ffff888007c82c78 R14: ffff888007c82c68 R15: ffff888007c82c68FS:  0000000000000000(0000) GS:ffff88811b100000(0000) knlGS:0000000000000000CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033CR2: ffffc9000d97fff8 CR3: 0000000102309002 CR4: 0000000000770ef0PKRU: 55555554Call Trace: <#DF> </#DF> <TASK> fib6_dump_done (net/ipv6/ip6_fib.c:572 (discriminator 1)) fib6_dump_done (net/ipv6/ip6_fib.c:572 (discriminator 1)) ... fib6_dump_done (net/ipv6/ip6_fib.c:572 (discriminator 1)) fib6_dump_done (net/ipv6/ip6_fib.c:572 (discriminator 1)) netlink_sock_destruct (net/netlink/af_netlink.c:401) __sk_destruct (net/core/sock.c:2177 (discriminator 2)) sk_destruct (net/core/sock.c:2224) __sk_free (net/core/sock.c:2235) sk_free (net/core/sock.c:2246) process_one_work (kernel/workqueue.c:3259) worker_thread (kernel/workqueue.c:3329 kernel/workqueue.---truncated---
 漏洞公开时间：2024-05-19 17:15:09
 漏洞创建时间：2024-05-19 09:54:25
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2024-35886
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/167d4b47a9bdcb01541dfa29e9f3cbb8edd3dfd2 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/40a344b2ddc06c1a2caa7208a43911f39c662778 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/4a7c465a5dcd657d59d25bf4815e19ac05c13061 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/9472d07cd095cbd3294ac54c42f304a38fbe9bfe |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/9c5258196182c25b55c33167cd72fdd9bbf08985 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/d21d40605bca7bd5fc23ef03d4c1ca1f48bc2cae |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/f2dd75e57285f49e34af1a5b6cd8945c08243776 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/fd307f2d91d40fa7bc55df3e2cd1253fabf8a2d6 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-35886 | https://bugzilla.suse.com/show_bug.cgi?id=1224670 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2024-35886 | https://bugzilla.suse.com/show_bug.cgi?id=1224670 |
| suse_bugzilla | https://git.kernel.org/stable/c/167d4b47a9bdcb01541dfa29e9f3cbb8edd3dfd2 | https://bugzilla.suse.com/show_bug.cgi?id=1224670 |
| suse_bugzilla | https://git.kernel.org/stable/c/40a344b2ddc06c1a2caa7208a43911f39c662778 | https://bugzilla.suse.com/show_bug.cgi?id=1224670 |
| suse_bugzilla | https://git.kernel.org/stable/c/4a7c465a5dcd657d59d25bf4815e19ac05c13061 | https://bugzilla.suse.com/show_bug.cgi?id=1224670 |
| suse_bugzilla | https://git.kernel.org/stable/c/9472d07cd095cbd3294ac54c42f304a38fbe9bfe | https://bugzilla.suse.com/show_bug.cgi?id=1224670 |
| suse_bugzilla | https://git.kernel.org/stable/c/9c5258196182c25b55c33167cd72fdd9bbf08985 | https://bugzilla.suse.com/show_bug.cgi?id=1224670 |
| suse_bugzilla | https://git.kernel.org/stable/c/d21d40605bca7bd5fc23ef03d4c1ca1f48bc2cae | https://bugzilla.suse.com/show_bug.cgi?id=1224670 |
| suse_bugzilla | https://git.kernel.org/stable/c/f2dd75e57285f49e34af1a5b6cd8945c08243776 | https://bugzilla.suse.com/show_bug.cgi?id=1224670 |
| suse_bugzilla | https://git.kernel.org/stable/c/fd307f2d91d40fa7bc55df3e2cd1253fabf8a2d6 | https://bugzilla.suse.com/show_bug.cgi?id=1224670 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2024/CVE-2024-35886.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1224670 |
| redhat_bugzilla | https://lore.kernel.org/linux-cve-announce/2024051946-CVE-2024-35886-19d4@gregkh/T | https://bugzilla.redhat.com/show_bug.cgi?id=2281697 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2024-35886 |
| anolis |  | https://anas.openanolis.cn/cves/detail/CVE-2024-35886 |
| cve_search |  | https://git.kernel.org/stable/c/9472d07cd095cbd3294ac54c42f304a38fbe9bfe |
| cve_search |  | https://git.kernel.org/stable/c/9c5258196182c25b55c33167cd72fdd9bbf08985 |
| cve_search |  | https://git.kernel.org/stable/c/fd307f2d91d40fa7bc55df3e2cd1253fabf8a2d6 |
| cve_search |  | https://git.kernel.org/stable/c/40a344b2ddc06c1a2caa7208a43911f39c662778 |
| cve_search |  | https://git.kernel.org/stable/c/167d4b47a9bdcb01541dfa29e9f3cbb8edd3dfd2 |
| cve_search |  | https://git.kernel.org/stable/c/f2dd75e57285f49e34af1a5b6cd8945c08243776 |
| cve_search |  | https://git.kernel.org/stable/c/4a7c465a5dcd657d59d25bf4815e19ac05c13061 |
| cve_search |  | https://git.kernel.org/stable/c/d21d40605bca7bd5fc23ef03d4c1ca1f48bc2cae |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

无
</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:ipv6: Fix infinite recursion in fib6_dump_done().syzkaller reported infinite recursive calls of fib6_dump_done() duringnetlink socket destruction.  [1]From the log, syzkaller sent an AF_UNSPEC RTM_GETROUTE message, and thenthe response was generated.  The following recvmmsg() resumed the dumpfor IPv6, but the first call of inet6_dump_fib() failed at kzalloc() dueto the fault injection.  [0]  12:01:34 executing program 3:  r0 = socket$nl_route(0x10, 0x3, 0x0)  sendmsg$nl_route(r0, ... snip ...)  recvmmsg(r0, ... snip ...) (fail_nth: 8)Here, fib6_dump_done() was set to nlk_sk(sk)->cb.done, and the next callof inet6_dump_fib() set it to nlk_sk(sk)->cb.args[3].  syzkaller stoppedreceiving the response halfway through, and finally netlink_sock_destruct()called nlk_sk(sk)->cb.done().fib6_dump_done() calls fib6_dump_end() and nlk_sk(sk)->cb.done() if itis still not NULL.  fib6_dump_end() rewrites nlk_sk(sk)->cb.done() bynlk_sk(sk)->cb.args[3], but it has the same function, not NULL, callingitself recursively and hitting the stack guard page.To avoid the issue, let s set the destructor after kzalloc().[0]:FAULT_INJECTION: forcing a failure.name failslab, interval 1, probability 0, space 0, times 0CPU: 1 PID: 432110 Comm: syz-executor.3 Not tainted 6.8.0-12821-g537c2e91d354-dirty #11Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014Call Trace: <TASK> dump_stack_lvl (lib/dump_stack.c:117) should_fail_ex (lib/fault-inject.c:52 lib/fault-inject.c:153) should_failslab (mm/slub.c:3733) kmalloc_trace (mm/slub.c:3748 mm/slub.c:3827 mm/slub.c:3992) inet6_dump_fib (./include/linux/slab.h:628 ./include/linux/slab.h:749 net/ipv6/ip6_fib.c:662) rtnl_dump_all (net/core/rtnetlink.c:4029) netlink_dump (net/netlink/af_netlink.c:2269) netlink_recvmsg (net/netlink/af_netlink.c:1988) ____sys_recvmsg (net/socket.c:1046 net/socket.c:2801) ___sys_recvmsg (net/socket.c:2846) do_recvmmsg (net/socket.c:2943) __x64_sys_recvmmsg (net/socket.c:3041 net/socket.c:3034 net/socket.c:3034)[1]:BUG: TASK stack guard page was hit at 00000000f2fa9af1 (stack is 00000000b7912430..000000009a436beb)stack guard page: 0000 [#1] PREEMPT SMP KASANCPU: 1 PID: 223719 Comm: kworker/1:3 Not tainted 6.8.0-12821-g537c2e91d354-dirty #11Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014Workqueue: events netlink_sock_destruct_workRIP: 0010:fib6_dump_done (net/ipv6/ip6_fib.c:570)Code: 3c 24 e8 f3 e9 51 fd e9 28 fd ff ff 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 41 57 41 56 41 55 41 54 55 48 89 fd <53> 48 8d 5d 60 e8 b6 4d 07 fd 48 89 da 48 b8 00 00 00 00 00 fc ffRSP: 0018:ffffc9000d980000 EFLAGS: 00010293RAX: 0000000000000000 RBX: ffffffff84405990 RCX: ffffffff844059d3RDX: ffff8881028e0000 RSI: ffffffff84405ac2 RDI: ffff88810c02f358RBP: ffff88810c02f358 R08: 0000000000000007 R09: 0000000000000000R10: 0000000000000000 R11: 0000000000000224 R12: 0000000000000000R13: ffff888007c82c78 R14: ffff888007c82c68 R15: ffff888007c82c68FS:  0000000000000000(0000) GS:ffff88811b100000(0000) knlGS:0000000000000000CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033CR2: ffffc9000d97fff8 CR3: 0000000102309002 CR4: 0000000000770ef0PKRU: 55555554Call Trace: <#DF> </#DF> <TASK> fib6_dump_done (net/ipv6/ip6_fib.c:572 (discriminator 1)) fib6_dump_done (net/ipv6/ip6_fib.c:572 (discriminator 1)) ... fib6_dump_done (net/ipv6/ip6_fib.c:572 (discriminator 1)) fib6_dump_done (net/ipv6/ip6_fib.c:572 (discriminator 1)) netlink_sock_destruct (net/netlink/af_netlink.c:401) __sk_destruct (net/core/sock.c:2177 (discriminator 2)) sk_destruct (net/core/sock.c:2224) __sk_free (net/core/sock.c:2235) sk_free (net/core/sock.c:2246) process_one_work (kernel/workqueue.c:3259) worker_thread (kernel/workqueue.c:3329 kernel/workqueue.---truncated---
 openEuler评分：
  5.5
 Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP4(4.19.90):受影响
2.openEuler-22.03-LTS-SP1(5.10.0):受影响
3.openEuler-22.03-LTS-SP3(5.10.0):受影响
4.openEuler-22.03-LTS-SP4(5.10.0):受影响
5.master(6.6.0):不受影响
6.openEuler-24.03-LTS(6.6.0):不受影响
7.openEuler-24.03-LTS-Next(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP4(4.19.90):否
2.openEuler-22.03-LTS-SP1(5.10.0):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.master(6.6.0):否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-22.03-LTS-SP4(5.10.0):否

原因说明：
  1.master(6.6.0):
2.openEuler-20.03-LTS-SP4(4.19.90):
3.openEuler-22.03-LTS-SP1(5.10.0):
4.openEuler-22.03-LTS-SP3(5.10.0):
5.openEuler-22.03-LTS-SP4(5.10.0):
6.openEuler-24.03-LTS(6.6.0):
7.openEuler-24.03-LTS-Next(6.6.0):

src-openEuler/kernel
Closed

Content Risk Flag

Comments (39)

src-openEuler/kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2024-35886

Comments (39)

Search

src-openEuler/kernel
Closed