CVE-2024-35973

一、漏洞信息
 漏洞编号：[CVE-2024-35973](https://nvd.nist.gov/vuln/detail/CVE-2024-35973)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.0,6.1.14,6.1.19,6.1.5,6.1.6,6.1.8,6.4.0,6.6.0
 CVSS V2.0分值：
  BaseScore：0.0 Low
  Vector：CVSS：2.0/
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:geneve: fix header validation in geneve[6]_xmit_skbsyzbot is able to trigger an uninit-value in geneve_xmit() [1]Problem : While most ip tunnel helpers (like ip_tunnel_get_dsfield())uses skb_protocol(skb, true), pskb_inet_may_pull() is only usingskb->protocol.If anything else than ETH_P_IPV6 or ETH_P_IP is found in skb->protocol,pskb_inet_may_pull() does nothing at all.If a vlan tag was provided by the caller (af_packet in the syzbot case),the network header might not point to the correct location, and skblinear part could be smaller than expected.Add skb_vlan_inet_prepare() to perform a complete mac validation.Use this in geneve for the moment, I suspect we need to adopt thismore broadly.v4 - Jakub reported v3 broke l2_tos_ttl_inherit.sh selftest   - Only call __vlan_get_protocol() for vlan types.v2,v3 - Addressed Sabrina comments on v1 and v2[1]BUG: KMSAN: uninit-value in geneve_xmit_skb drivers/net/geneve.c:910 [inline] BUG: KMSAN: uninit-value in geneve_xmit+0x302d/0x5420 drivers/net/geneve.c:1030  geneve_xmit_skb drivers/net/geneve.c:910 [inline]  geneve_xmit+0x302d/0x5420 drivers/net/geneve.c:1030  __netdev_start_xmit include/linux/netdevice.h:4903 [inline]  netdev_start_xmit include/linux/netdevice.h:4917 [inline]  xmit_one net/core/dev.c:3531 [inline]  dev_hard_start_xmit+0x247/0xa20 net/core/dev.c:3547  __dev_queue_xmit+0x348d/0x52c0 net/core/dev.c:4335  dev_queue_xmit include/linux/netdevice.h:3091 [inline]  packet_xmit+0x9c/0x6c0 net/packet/af_packet.c:276  packet_snd net/packet/af_packet.c:3081 [inline]  packet_sendmsg+0x8bb0/0x9ef0 net/packet/af_packet.c:3113  sock_sendmsg_nosec net/socket.c:730 [inline]  __sock_sendmsg+0x30f/0x380 net/socket.c:745  __sys_sendto+0x685/0x830 net/socket.c:2191  __do_sys_sendto net/socket.c:2203 [inline]  __se_sys_sendto net/socket.c:2199 [inline]  __x64_sys_sendto+0x125/0x1d0 net/socket.c:2199 do_syscall_64+0xd5/0x1f0 entry_SYSCALL_64_after_hwframe+0x6d/0x75Uninit was created at:  slab_post_alloc_hook mm/slub.c:3804 [inline]  slab_alloc_node mm/slub.c:3845 [inline]  kmem_cache_alloc_node+0x613/0xc50 mm/slub.c:3888  kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:577  __alloc_skb+0x35b/0x7a0 net/core/skbuff.c:668  alloc_skb include/linux/skbuff.h:1318 [inline]  alloc_skb_with_frags+0xc8/0xbf0 net/core/skbuff.c:6504  sock_alloc_send_pskb+0xa81/0xbf0 net/core/sock.c:2795  packet_alloc_skb net/packet/af_packet.c:2930 [inline]  packet_snd net/packet/af_packet.c:3024 [inline]  packet_sendmsg+0x722d/0x9ef0 net/packet/af_packet.c:3113  sock_sendmsg_nosec net/socket.c:730 [inline]  __sock_sendmsg+0x30f/0x380 net/socket.c:745  __sys_sendto+0x685/0x830 net/socket.c:2191  __do_sys_sendto net/socket.c:2203 [inline]  __se_sys_sendto net/socket.c:2199 [inline]  __x64_sys_sendto+0x125/0x1d0 net/socket.c:2199 do_syscall_64+0xd5/0x1f0 entry_SYSCALL_64_after_hwframe+0x6d/0x75CPU: 0 PID: 5033 Comm: syz-executor346 Not tainted 6.9.0-rc1-syzkaller-00005-g928a87efa423 #0Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024
 漏洞公开时间：2024-05-20 18:15:12
 漏洞创建时间：2024-05-20 18:26:45
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2024-35973
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/10204df9beda4978bd1d0c2db0d8375bfb03b915 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/190d9efa5773f26d6f334b1b8be282c4fa13fd5e |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/357163fff3a6e48fe74745425a32071ec9caf852 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/3c1ae6de74e3d2d6333d29a2d3e13e6094596c79 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/43be590456e1f3566054ce78ae2dbb68cbe1a536 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/4a1b65d1e55d53b397cb27014208be1e04172670 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/d3adf11d7993518a39bd02b383cfe657ccc0023c |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/d8a6213d70accb403b82924a1c229e733433a5ef |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-35973 | https://bugzilla.suse.com/show_bug.cgi?id=1224586 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2024-35973 | https://bugzilla.suse.com/show_bug.cgi?id=1224586 |
| suse_bugzilla | https://git.kernel.org/stable/c/10204df9beda4978bd1d0c2db0d8375bfb03b915 | https://bugzilla.suse.com/show_bug.cgi?id=1224586 |
| suse_bugzilla | https://git.kernel.org/stable/c/190d9efa5773f26d6f334b1b8be282c4fa13fd5e | https://bugzilla.suse.com/show_bug.cgi?id=1224586 |
| suse_bugzilla | https://git.kernel.org/stable/c/357163fff3a6e48fe74745425a32071ec9caf852 | https://bugzilla.suse.com/show_bug.cgi?id=1224586 |
| suse_bugzilla | https://git.kernel.org/stable/c/3c1ae6de74e3d2d6333d29a2d3e13e6094596c79 | https://bugzilla.suse.com/show_bug.cgi?id=1224586 |
| suse_bugzilla | https://git.kernel.org/stable/c/43be590456e1f3566054ce78ae2dbb68cbe1a536 | https://bugzilla.suse.com/show_bug.cgi?id=1224586 |
| suse_bugzilla | https://git.kernel.org/stable/c/4a1b65d1e55d53b397cb27014208be1e04172670 | https://bugzilla.suse.com/show_bug.cgi?id=1224586 |
| suse_bugzilla | https://git.kernel.org/stable/c/d3adf11d7993518a39bd02b383cfe657ccc0023c | https://bugzilla.suse.com/show_bug.cgi?id=1224586 |
| suse_bugzilla | https://git.kernel.org/stable/c/d8a6213d70accb403b82924a1c229e733433a5ef | https://bugzilla.suse.com/show_bug.cgi?id=1224586 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2024/CVE-2024-35973.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1224586 |
| redhat_bugzilla | https://lore.kernel.org/linux-cve-announce/2024052024-CVE-2024-35973-1b5b@gregkh/T | https://bugzilla.redhat.com/show_bug.cgi?id=2281891 |
| ubuntu | https://www.cve.org/CVERecord?id=CVE-2024-35973 | https://ubuntu.com/security/CVE-2024-35973 |
| ubuntu | https://git.kernel.org/linus/d8a6213d70accb403b82924a1c229e733433a5ef (6.9-rc4) | https://ubuntu.com/security/CVE-2024-35973 |
| ubuntu | https://git.kernel.org/stable/c/43be590456e1f3566054ce78ae2dbb68cbe1a536 | https://ubuntu.com/security/CVE-2024-35973 |
| ubuntu | https://git.kernel.org/stable/c/d3adf11d7993518a39bd02b383cfe657ccc0023c | https://ubuntu.com/security/CVE-2024-35973 |
| ubuntu | https://git.kernel.org/stable/c/10204df9beda4978bd1d0c2db0d8375bfb03b915 | https://ubuntu.com/security/CVE-2024-35973 |
| ubuntu | https://git.kernel.org/stable/c/3c1ae6de74e3d2d6333d29a2d3e13e6094596c79 | https://ubuntu.com/security/CVE-2024-35973 |
| ubuntu | https://git.kernel.org/stable/c/4a1b65d1e55d53b397cb27014208be1e04172670 | https://ubuntu.com/security/CVE-2024-35973 |
| ubuntu | https://git.kernel.org/stable/c/190d9efa5773f26d6f334b1b8be282c4fa13fd5e | https://ubuntu.com/security/CVE-2024-35973 |
| ubuntu | https://git.kernel.org/stable/c/357163fff3a6e48fe74745425a32071ec9caf852 | https://ubuntu.com/security/CVE-2024-35973 |
| ubuntu | https://git.kernel.org/stable/c/d8a6213d70accb403b82924a1c229e733433a5ef | https://ubuntu.com/security/CVE-2024-35973 |
| ubuntu | https://nvd.nist.gov/vuln/detail/CVE-2024-35973 | https://ubuntu.com/security/CVE-2024-35973 |
| ubuntu | https://launchpad.net/bugs/cve/CVE-2024-35973 | https://ubuntu.com/security/CVE-2024-35973 |
| ubuntu | https://security-tracker.debian.org/tracker/CVE-2024-35973 | https://ubuntu.com/security/CVE-2024-35973 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2024-35973 |
| cve_search |  | https://git.kernel.org/stable/c/43be590456e1f3566054ce78ae2dbb68cbe1a536 |
| cve_search |  | https://git.kernel.org/stable/c/d3adf11d7993518a39bd02b383cfe657ccc0023c |
| cve_search |  | https://git.kernel.org/stable/c/10204df9beda4978bd1d0c2db0d8375bfb03b915 |
| cve_search |  | https://git.kernel.org/stable/c/3c1ae6de74e3d2d6333d29a2d3e13e6094596c79 |
| cve_search |  | https://git.kernel.org/stable/c/4a1b65d1e55d53b397cb27014208be1e04172670 |
| cve_search |  | https://git.kernel.org/stable/c/190d9efa5773f26d6f334b1b8be282c4fa13fd5e |
| cve_search |  | https://git.kernel.org/stable/c/357163fff3a6e48fe74745425a32071ec9caf852 |
| cve_search |  | https://git.kernel.org/stable/c/d8a6213d70accb403b82924a1c229e733433a5ef |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
| linux |  | https://git.kernel.org/linus/d8a6213d70accb403b82924a1c229e733433a5ef | https://git.kernel.org/linus/d13f048dd40e8577260cd43faea8ec9b77520197 | ubuntu |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
                In the Linux kernel, the following vulnerability has been resolved:geneve: fix header validation in geneve[6]_xmit_skbsyzbot is able to trigger an uninit-value in geneve_xmit() [1]Problem : While most ip tunnel helpers (like ip_tunnel_get_dsfield())uses skb_protocol(skb, true), pskb_inet_may_pull() is only usingskb->protocol.If anything else than ETH_P_IPV6 or ETH_P_IP is found in skb->protocol,pskb_inet_may_pull() does nothing at all.If a vlan tag was provided by the caller (af_packet in the syzbot case),the network header might not point to the correct location, and skblinear part could be smaller than expected.Add skb_vlan_inet_prepare() to perform a complete mac validation.Use this in geneve for the moment, I suspect we need to adopt thismore broadly.v4 - Jakub reported v3 broke l2_tos_ttl_inherit.sh selftest   - Only call __vlan_get_protocol() for vlan types.v2,v3 - Addressed Sabrina comments on v1 and v2[1]BUG: KMSAN: uninit-value in geneve_xmit_skb drivers/net/geneve.c:910 [inline] BUG: KMSAN: uninit-value in geneve_xmit+0x302d/0x5420 drivers/net/geneve.c:1030  geneve_xmit_skb drivers/net/geneve.c:910 [inline]  geneve_xmit+0x302d/0x5420 drivers/net/geneve.c:1030  __netdev_start_xmit include/linux/netdevice.h:4903 [inline]  netdev_start_xmit include/linux/netdevice.h:4917 [inline]  xmit_one net/core/dev.c:3531 [inline]  dev_hard_start_xmit+0x247/0xa20 net/core/dev.c:3547  __dev_queue_xmit+0x348d/0x52c0 net/core/dev.c:4335  dev_queue_xmit include/linux/netdevice.h:3091 [inline]  packet_xmit+0x9c/0x6c0 net/packet/af_packet.c:276  packet_snd net/packet/af_packet.c:3081 [inline]  packet_sendmsg+0x8bb0/0x9ef0 net/packet/af_packet.c:3113  sock_sendmsg_nosec net/socket.c:730 [inline]  __sock_sendmsg+0x30f/0x380 net/socket.c:745  __sys_sendto+0x685/0x830 net/socket.c:2191  __do_sys_sendto net/socket.c:2203 [inline]  __se_sys_sendto net/socket.c:2199 [inline]  __x64_sys_sendto+0x125/0x1d0 net/socket.c:2199 do_syscall_64+0xd5/0x1f0 entry_SYSCALL_64_after_hwframe+0x6d/0x75Uninit was created at:  slab_post_alloc_hook mm/slub.c:3804 [inline]  slab_alloc_node mm/slub.c:3845 [inline]  kmem_cache_alloc_node+0x613/0xc50 mm/slub.c:3888  kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:577  __alloc_skb+0x35b/0x7a0 net/core/skbuff.c:668  alloc_skb include/linux/skbuff.h:1318 [inline]  alloc_skb_with_frags+0xc8/0xbf0 net/core/skbuff.c:6504  sock_alloc_send_pskb+0xa81/0xbf0 net/core/sock.c:2795  packet_alloc_skb net/packet/af_packet.c:2930 [inline]  packet_snd net/packet/af_packet.c:3024 [inline]  packet_sendmsg+0x722d/0x9ef0 net/packet/af_packet.c:3113  sock_sendmsg_nosec net/socket.c:730 [inline]  __sock_sendmsg+0x30f/0x380 net/socket.c:745  __sys_sendto+0x685/0x830 net/socket.c:2191  __do_sys_sendto net/socket.c:2203 [inline]  __se_sys_sendto net/socket.c:2199 [inline]  __x64_sys_sendto+0x125/0x1d0 net/socket.c:2199 do_syscall_64+0xd5/0x1f0 entry_SYSCALL_64_after_hwframe+0x6d/0x75CPU: 0 PID: 5033 Comm: syz-executor346 Not tainted 6.9.0-rc1-syzkaller-00005-g928a87efa423 #0Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024       
 openEuler评分：
  5.5
 Vector：CVSS：2.0/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:N
 受影响版本排查(受影响/不受影响)：
  1.openEuler-22.03-LTS-SP1(5.10.0):受影响
2.openEuler-22.03-LTS-SP3(5.10.0):受影响
3.openEuler-20.03-LTS-SP1(4.19.90):不受影响
4.openEuler-20.03-LTS-SP4(4.19.90):不受影响
5.openEuler-22.03-LTS(5.10.0):不受影响
6.openEuler-22.03-LTS-SP2(5.10.0):不受影响
7.openEuler-22.03-LTS-SP4(5.10.0):不受影响
8.master(6.1.0):不受影响
9.openEuler-22.03-LTS-Next(5.10.0):不受影响
10.openEuler-24.03-LTS(6.6.0):不受影响
11.openEuler-24.03-LTS-Next(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP1(4.19.90):否
2.openEuler-20.03-LTS-SP4(4.19.90):否
3.openEuler-22.03-LTS(5.10.0):否
4.openEuler-22.03-LTS-SP1(5.10.0):否
5.openEuler-22.03-LTS-SP2(5.10.0):否
6.openEuler-22.03-LTS-SP3(5.10.0):否
7.master(6.1.0):否
8.openEuler-22.03-LTS-Next(5.10.0):否
9.openEuler-24.03-LTS(6.6.0):否
10.openEuler-24.03-LTS-Next(6.6.0):否
11.openEuler-22.03-LTS-SP4(5.10.0):否

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2024-1707

src-openEuler/kernel
Closed

Content Risk Flag

Comments (21)

src-openEuler/kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2024-35973

Comments (21)

Search

src-openEuler/kernel
Closed