CVE-2024-36004

一、漏洞信息
 漏洞编号：[CVE-2024-36004](https://nvd.nist.gov/vuln/detail/CVE-2024-36004)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.0,6.1.14,6.1.19,6.1.5,6.1.6,6.1.8,6.4.0,6.6.0
 CVSS V2.0分值：
  BaseScore：0.0 None
  Vector：CVSS：2.0/
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:i40e: Do not use WQ_MEM_RECLAIM flag for workqueueIssue reported by customer during SRIOV testing, call trace:When both i40e and the i40iw driver are loaded, a warningin check_flush_dependency is being triggered. This seemsto be because of the i40e driver workqueue is allocated withthe WQ_MEM_RECLAIM flag, and the i40iw one is not.Similar error was encountered on ice too and it was fixed byremoving the flag. Do the same for i40e too.[Feb 9 09:08] ------------[ cut here ]------------[  +0.000004] workqueue: WQ_MEM_RECLAIM i40e:i40e_service_task [i40e] isflushing !WQ_MEM_RECLAIM infiniband:0x0[  +0.000060] WARNING: CPU: 0 PID: 937 at kernel/workqueue.c:2966check_flush_dependency+0x10b/0x120[  +0.000007] Modules linked in: snd_seq_dummy snd_hrtimer snd_seqsnd_timer snd_seq_device snd soundcore nls_utf8 cifs cifs_arc4nls_ucs2_utils rdma_cm iw_cm ib_cm cifs_md4 dns_resolver netfs qrtrrfkill sunrpc vfat fat intel_rapl_msr intel_rapl_common irdmaintel_uncore_frequency intel_uncore_frequency_common ice ipmi_ssifisst_if_common skx_edac nfit libnvdimm x86_pkg_temp_thermalintel_powerclamp gnss coretemp ib_uverbs rapl intel_cstate ib_coreiTCO_wdt iTCO_vendor_support acpi_ipmi mei_me ipmi_si intel_uncoreioatdma i2c_i801 joydev pcspkr mei ipmi_devintf lpc_ichintel_pch_thermal i2c_smbus ipmi_msghandler acpi_power_meter acpi_padxfs libcrc32c ast sd_mod drm_shmem_helper t10_pi drm_kms_helper sg ixgbedrm i40e ahci crct10dif_pclmul libahci crc32_pclmul igb crc32c_intellibata ghash_clmulni_intel i2c_algo_bit mdio dca wmi dm_mirrordm_region_hash dm_log dm_mod fuse[  +0.000050] CPU: 0 PID: 937 Comm: kworker/0:3 Kdump: loaded Nottainted 6.8.0-rc2-Feb-net_dev-Qiueue-00279-gbd43c5687e05 #1[  +0.000003] Hardware name: Intel Corporation S2600BPB/S2600BPB, BIOSSE5C620.86B.02.01.0013.121520200651 12/15/2020[  +0.000001] Workqueue: i40e i40e_service_task [i40e][  +0.000024] RIP: 0010:check_flush_dependency+0x10b/0x120[  +0.000003] Code: ff 49 8b 54 24 18 48 8d 8b b0 00 00 00 49 89 e8 4881 c6 b0 00 00 00 48 c7 c7 b0 97 fa 9f c6 05 8a cc 1f 02 01 e8 35 b3 fdff <0f> 0b e9 10 ff ff ff 80 3d 78 cc 1f 02 00 75 94 e9 46 ff ff ff 90[  +0.000002] RSP: 0018:ffffbd294976bcf8 EFLAGS: 00010282[  +0.000002] RAX: 0000000000000000 RBX: ffff94d4c483c000 RCX:0000000000000027[  +0.000001] RDX: ffff94d47f620bc8 RSI: 0000000000000001 RDI:ffff94d47f620bc0[  +0.000001] RBP: 0000000000000000 R08: 0000000000000000 R09:00000000ffff7fff[  +0.000001] R10: ffffbd294976bb98 R11: ffffffffa0be65e8 R12:ffff94c5451ea180[  +0.000001] R13: ffff94c5ab5e8000 R14: ffff94c5c20b6e05 R15:ffff94c5f1330ab0[  +0.000001] FS:  0000000000000000(0000) GS:ffff94d47f600000(0000)knlGS:0000000000000000[  +0.000002] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033[  +0.000001] CR2: 00007f9e6f1fca70 CR3: 0000000038e20004 CR4:00000000007706f0[  +0.000000] DR0: 0000000000000000 DR1: 0000000000000000 DR2:0000000000000000[  +0.000001] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7:0000000000000400[  +0.000001] PKRU: 55555554[  +0.000001] Call Trace:[  +0.000001]  <TASK>[  +0.000002]  ? __warn+0x80/0x130[  +0.000003]  ? check_flush_dependency+0x10b/0x120[  +0.000002]  ? report_bug+0x195/0x1a0[  +0.000005]  ? handle_bug+0x3c/0x70[  +0.000003]  ? exc_invalid_op+0x14/0x70[  +0.000002]  ? asm_exc_invalid_op+0x16/0x20[  +0.000006]  ? check_flush_dependency+0x10b/0x120[  +0.000002]  ? check_flush_dependency+0x10b/0x120[  +0.000002]  __flush_workqueue+0x126/0x3f0[  +0.000015]  ib_cache_cleanup_one+0x1c/0xe0 [ib_core][  +0.000056]  __ib_unregister_device+0x6a/0xb0 [ib_core][  +0.000023]  ib_unregister_device_and_put+0x34/0x50 [ib_core][  +0.000020]  i40iw_close+0x4b/0x90 [irdma][  +0.000022]  i40e_notify_client_of_netdev_close+0x54/0xc0 [i40e][  +0.000035]  i40e_service_task+0x126/0x190 [i40e][  +0.000024]  process_one_work+0x174/0x340[  +0.000003]  worker_th---truncated---
 漏洞公开时间：2024-05-20 18:15:14
 漏洞创建时间：2024-05-20 10:36:41
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2024-36004
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/09b54d29f05129b092f7c793a70b689ffb3c7b2c |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/152ed360cf2d273f88fc99a518b7eb868aae2939 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/1594dac8b1ed78f9e75c263327e198a2e5e25b0e |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/2cc7d150550cc981aceedf008f5459193282425c |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/546d0fe9d76e8229a67369f9cb61e961d99038bd |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/8d6105f637883c8c09825e962308c06e977de4f0 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/fbbb2404340dd6178e281bd427c271f7d5ec1d22 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/ff7431f898dd00892a545b7d0ce7adf5b926944f |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-36004 | https://bugzilla.suse.com/show_bug.cgi?id=1224545 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2024-36004 | https://bugzilla.suse.com/show_bug.cgi?id=1224545 |
| suse_bugzilla | https://git.kernel.org/stable/c/09b54d29f05129b092f7c793a70b689ffb3c7b2c | https://bugzilla.suse.com/show_bug.cgi?id=1224545 |
| suse_bugzilla | https://git.kernel.org/stable/c/152ed360cf2d273f88fc99a518b7eb868aae2939 | https://bugzilla.suse.com/show_bug.cgi?id=1224545 |
| suse_bugzilla | https://git.kernel.org/stable/c/1594dac8b1ed78f9e75c263327e198a2e5e25b0e | https://bugzilla.suse.com/show_bug.cgi?id=1224545 |
| suse_bugzilla | https://git.kernel.org/stable/c/2cc7d150550cc981aceedf008f5459193282425c | https://bugzilla.suse.com/show_bug.cgi?id=1224545 |
| suse_bugzilla | https://git.kernel.org/stable/c/546d0fe9d76e8229a67369f9cb61e961d99038bd | https://bugzilla.suse.com/show_bug.cgi?id=1224545 |
| suse_bugzilla | https://git.kernel.org/stable/c/8d6105f637883c8c09825e962308c06e977de4f0 | https://bugzilla.suse.com/show_bug.cgi?id=1224545 |
| suse_bugzilla | https://git.kernel.org/stable/c/fbbb2404340dd6178e281bd427c271f7d5ec1d22 | https://bugzilla.suse.com/show_bug.cgi?id=1224545 |
| suse_bugzilla | https://git.kernel.org/stable/c/ff7431f898dd00892a545b7d0ce7adf5b926944f | https://bugzilla.suse.com/show_bug.cgi?id=1224545 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2024/CVE-2024-36004.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1224545 |
| redhat_bugzilla | https://lore.kernel.org/linux-cve-announce/2024052024-CVE-2024-36004-fb45@gregkh/T | https://bugzilla.redhat.com/show_bug.cgi?id=2281953 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:4211 | https://bugzilla.redhat.com/show_bug.cgi?id=2281953 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:4352 | https://bugzilla.redhat.com/show_bug.cgi?id=2281953 |
| ubuntu | https://www.cve.org/CVERecord?id=CVE-2024-36004 | https://ubuntu.com/security/CVE-2024-36004 |
| ubuntu | https://git.kernel.org/linus/2cc7d150550cc981aceedf008f5459193282425c (6.9-rc6) | https://ubuntu.com/security/CVE-2024-36004 |
| ubuntu | https://git.kernel.org/stable/c/09b54d29f05129b092f7c793a70b689ffb3c7b2c | https://ubuntu.com/security/CVE-2024-36004 |
| ubuntu | https://git.kernel.org/stable/c/546d0fe9d76e8229a67369f9cb61e961d99038bd | https://ubuntu.com/security/CVE-2024-36004 |
| ubuntu | https://git.kernel.org/stable/c/fbbb2404340dd6178e281bd427c271f7d5ec1d22 | https://ubuntu.com/security/CVE-2024-36004 |
| ubuntu | https://git.kernel.org/stable/c/ff7431f898dd00892a545b7d0ce7adf5b926944f | https://ubuntu.com/security/CVE-2024-36004 |
| ubuntu | https://git.kernel.org/stable/c/152ed360cf2d273f88fc99a518b7eb868aae2939 | https://ubuntu.com/security/CVE-2024-36004 |
| ubuntu | https://git.kernel.org/stable/c/8d6105f637883c8c09825e962308c06e977de4f0 | https://ubuntu.com/security/CVE-2024-36004 |
| ubuntu | https://git.kernel.org/stable/c/1594dac8b1ed78f9e75c263327e198a2e5e25b0e | https://ubuntu.com/security/CVE-2024-36004 |
| ubuntu | https://git.kernel.org/stable/c/2cc7d150550cc981aceedf008f5459193282425c | https://ubuntu.com/security/CVE-2024-36004 |
| ubuntu | https://ubuntu.com/security/notices/USN-6896-1 | https://ubuntu.com/security/CVE-2024-36004 |
| ubuntu | https://ubuntu.com/security/notices/USN-6898-1 | https://ubuntu.com/security/CVE-2024-36004 |
| ubuntu | https://ubuntu.com/security/notices/USN-6896-2 | https://ubuntu.com/security/CVE-2024-36004 |
| ubuntu | https://nvd.nist.gov/vuln/detail/CVE-2024-36004 | https://ubuntu.com/security/CVE-2024-36004 |
| ubuntu | https://launchpad.net/bugs/cve/CVE-2024-36004 | https://ubuntu.com/security/CVE-2024-36004 |
| ubuntu | https://security-tracker.debian.org/tracker/CVE-2024-36004 | https://ubuntu.com/security/CVE-2024-36004 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2024-36004 |
| anolis |  | https://anas.openanolis.cn/cves/detail/CVE-2024-36004 |
| mageia |  | http://advisories.mageia.org/MGASA-2024-0263.html |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
| linux |  | https://git.kernel.org/linus/2cc7d150550cc981aceedf008f5459193282425c | https://git.kernel.org/linus/4d5957cbdecdbb77d24c1465caadd801c07afa4a | ubuntu |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
          In the Linux kernel, the following vulnerability has been resolved:i40e: Do not use WQ_MEM_RECLAIM flag for workqueueIssue reported by customer during SRIOV testing, call trace:When both i40e and the i40iw driver are loaded, a warningin check_flush_dependency is being triggered. This seemsto be because of the i40e driver workqueue is allocated withthe WQ_MEM_RECLAIM flag, and the i40iw one is not.Similar error was encountered on ice too and it was fixed byremoving the flag. Do the same for i40e too.[Feb 9 09:08] ------------[ cut here ]------------[  +0.000004] workqueue: WQ_MEM_RECLAIM i40e:i40e_service_task [i40e] isflushing !WQ_MEM_RECLAIM infiniband:0x0[  +0.000060] WARNING: CPU: 0 PID: 937 at kernel/workqueue.c:2966check_flush_dependency+0x10b/0x120[  +0.000007] Modules linked in: snd_seq_dummy snd_hrtimer snd_seqsnd_timer snd_seq_device snd soundcore nls_utf8 cifs cifs_arc4nls_ucs2_utils rdma_cm iw_cm ib_cm cifs_md4 dns_resolver netfs qrtrrfkill sunrpc vfat fat intel_rapl_msr intel_rapl_common irdmaintel_uncore_frequency intel_uncore_frequency_common ice ipmi_ssifisst_if_common skx_edac nfit libnvdimm x86_pkg_temp_thermalintel_powerclamp gnss coretemp ib_uverbs rapl intel_cstate ib_coreiTCO_wdt iTCO_vendor_support acpi_ipmi mei_me ipmi_si intel_uncoreioatdma i2c_i801 joydev pcspkr mei ipmi_devintf lpc_ichintel_pch_thermal i2c_smbus ipmi_msghandler acpi_power_meter acpi_padxfs libcrc32c ast sd_mod drm_shmem_helper t10_pi drm_kms_helper sg ixgbedrm i40e ahci crct10dif_pclmul libahci crc32_pclmul igb crc32c_intellibata ghash_clmulni_intel i2c_algo_bit mdio dca wmi dm_mirrordm_region_hash dm_log dm_mod fuse[  +0.000050] CPU: 0 PID: 937 Comm: kworker/0:3 Kdump: loaded Nottainted 6.8.0-rc2-Feb-net_dev-Qiueue-00279-gbd43c5687e05 #1[  +0.000003] Hardware name: Intel Corporation S2600BPB/S2600BPB, BIOSSE5C620.86B.02.01.0013.121520200651 12/15/2020[  +0.000001] Workqueue: i40e i40e_service_task [i40e][  +0.000024] RIP: 0010:check_flush_dependency+0x10b/0x120[  +0.000003] Code: ff 49 8b 54 24 18 48 8d 8b b0 00 00 00 49 89 e8 4881 c6 b0 00 00 00 48 c7 c7 b0 97 fa 9f c6 05 8a cc 1f 02 01 e8 35 b3 fdff <0f> 0b e9 10 ff ff ff 80 3d 78 cc 1f 02 00 75 94 e9 46 ff ff ff 90[  +0.000002] RSP: 0018:ffffbd294976bcf8 EFLAGS: 00010282[  +0.000002] RAX: 0000000000000000 RBX: ffff94d4c483c000 RCX:0000000000000027[  +0.000001] RDX: ffff94d47f620bc8 RSI: 0000000000000001 RDI:ffff94d47f620bc0[  +0.000001] RBP: 0000000000000000 R08: 0000000000000000 R09:00000000ffff7fff[  +0.000001] R10: ffffbd294976bb98 R11: ffffffffa0be65e8 R12:ffff94c5451ea180[  +0.000001] R13: ffff94c5ab5e8000 R14: ffff94c5c20b6e05 R15:ffff94c5f1330ab0[  +0.000001] FS:  0000000000000000(0000) GS:ffff94d47f600000(0000)knlGS:0000000000000000[  +0.000002] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033[  +0.000001] CR2: 00007f9e6f1fca70 CR3: 0000000038e20004 CR4:00000000007706f0[  +0.000000] DR0: 0000000000000000 DR1: 0000000000000000 DR2:0000000000000000[  +0.000001] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7:0000000000000400[  +0.000001] PKRU: 55555554[  +0.000001] Call Trace:[  +0.000001]  <TASK>[  +0.000002]  ? __warn+0x80/0x130[  +0.000003]  ? check_flush_dependency+0x10b/0x120[  +0.000002]  ? report_bug+0x195/0x1a0[  +0.000005]  ? handle_bug+0x3c/0x70[  +0.000003]  ? exc_invalid_op+0x14/0x70[  +0.000002]  ? asm_exc_invalid_op+0x16/0x20[  +0.000006]  ? check_flush_dependency+0x10b/0x120[  +0.000002]  ? check_flush_dependency+0x10b/0x120[  +0.000002]  __flush_workqueue+0x126/0x3f0[  +0.000015]  ib_cache_cleanup_one+0x1c/0xe0 [ib_core][  +0.000056]  __ib_unregister_device+0x6a/0xb0 [ib_core][  +0.000023]  ib_unregister_device_and_put+0x34/0x50 [ib_core][  +0.000020]  i40iw_close+0x4b/0x90 [irdma][  +0.000022]  i40e_notify_client_of_netdev_close+0x54/0xc0 [i40e][  +0.000035]  i40e_service_task+0x126/0x190 [i40e][  +0.000024]  process_one_work+0x174/0x340[  +0.000003]  worker_th---truncated---    
 openEuler评分：
  5.5
 Vector：CVSS：2.0/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:N
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP1(4.19.90):受影响
2.openEuler-20.03-LTS-SP4(4.19.90):受影响
3.openEuler-22.03-LTS(5.10.0):受影响
4.openEuler-22.03-LTS-SP1(5.10.0):受影响
5.openEuler-22.03-LTS-SP2(5.10.0):受影响
6.openEuler-22.03-LTS-SP3(5.10.0):受影响
7.openEuler-22.03-LTS-SP4(5.10.0):不受影响
8.master(6.6.0):不受影响
9.openEuler-22.03-LTS-Next(5.10.0):不受影响
10.openEuler-24.03-LTS(6.6.0):不受影响
11.openEuler-24.03-LTS-Next(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP1(4.19.90):否
2.openEuler-20.03-LTS-SP4(4.19.90):否
3.openEuler-22.03-LTS(5.10.0):否
4.openEuler-22.03-LTS-SP1(5.10.0):否
5.openEuler-22.03-LTS-SP2(5.10.0):否
6.openEuler-22.03-LTS-SP3(5.10.0):否
7.master(6.6.0):否
8.openEuler-22.03-LTS-Next(5.10.0):否
9.openEuler-24.03-LTS(6.6.0):否
10.openEuler-24.03-LTS-Next(6.6.0):否
11.openEuler-22.03-LTS-SP4(5.10.0):否

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2024-2295

src-openEuler/kernel

Content Risk Flag

Comments (29)

src-openEuler/kernel .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2024-36004

Comments (29)

Search

src-openEuler/kernel