CVE-2024-35989

一、漏洞信息
 漏洞编号：[CVE-2024-35989](https://nvd.nist.gov/vuln/detail/CVE-2024-35989)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.0,6.1.14,6.1.19,6.1.5,6.1.6,6.1.8,6.4.0,6.6.0
 CVSS V2.0分值：
  BaseScore：0.0 None
  Vector：CVSS：2.0/
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:dmaengine: idxd: Fix oops during rmmod on single-CPU platformsDuring the removal of the idxd driver, registered offline callback isinvoked as part of the clean up process. However, on systems with onlyone CPU online, no valid target is available to migrate theperf context, resulting in a kernel oops:    BUG: unable to handle page fault for address: 000000000002a2b8    #PF: supervisor write access in kernel mode    #PF: error_code(0x0002) - not-present page    PGD 1470e1067 P4D 0    Oops: 0002 [#1] PREEMPT SMP NOPTI    CPU: 0 PID: 20 Comm: cpuhp/0 Not tainted 6.8.0-rc6-dsa+ #57    Hardware name: Intel Corporation AvenueCity/AvenueCity, BIOS BHSDCRB1.86B.2492.D03.2307181620 07/18/2023    RIP: 0010:mutex_lock+0x2e/0x50    ...    Call Trace:    <TASK>    __die+0x24/0x70    page_fault_oops+0x82/0x160    do_user_addr_fault+0x65/0x6b0    __pfx___rdmsr_safe_on_cpu+0x10/0x10    exc_page_fault+0x7d/0x170    asm_exc_page_fault+0x26/0x30    mutex_lock+0x2e/0x50    mutex_lock+0x1e/0x50    perf_pmu_migrate_context+0x87/0x1f0    perf_event_cpu_offline+0x76/0x90 [idxd]    cpuhp_invoke_callback+0xa2/0x4f0    __pfx_perf_event_cpu_offline+0x10/0x10 [idxd]    cpuhp_thread_fun+0x98/0x150    smpboot_thread_fn+0x27/0x260    smpboot_thread_fn+0x1af/0x260    __pfx_smpboot_thread_fn+0x10/0x10    kthread+0x103/0x140    __pfx_kthread+0x10/0x10    ret_from_fork+0x31/0x50    __pfx_kthread+0x10/0x10    ret_from_fork_asm+0x1b/0x30    <TASK>Fix the issue by preventing the migration of the perf context to aninvalid target.
 漏洞公开时间：2024-05-20 18:15:13
 漏洞创建时间：2024-05-20 18:51:34
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2024-35989
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/023b6390a15a98f9c3aa5e7da78d485d5384a08e |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/47533176fdcef17b114a6f688bc872901c1ec6bb |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/9edd3aa34d50f27b97be30b2ba4a6af0945ff56b |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/f221033f5c24659dc6ad7e5cf18fb1b075f4a8be |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/f976eca36cdf94e32fa4f865db0e7c427c9aa33c |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-35989 | https://bugzilla.suse.com/show_bug.cgi?id=1224558 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2024-35989 | https://bugzilla.suse.com/show_bug.cgi?id=1224558 |
| suse_bugzilla | https://git.kernel.org/stable/c/023b6390a15a98f9c3aa5e7da78d485d5384a08e | https://bugzilla.suse.com/show_bug.cgi?id=1224558 |
| suse_bugzilla | https://git.kernel.org/stable/c/47533176fdcef17b114a6f688bc872901c1ec6bb | https://bugzilla.suse.com/show_bug.cgi?id=1224558 |
| suse_bugzilla | https://git.kernel.org/stable/c/9edd3aa34d50f27b97be30b2ba4a6af0945ff56b | https://bugzilla.suse.com/show_bug.cgi?id=1224558 |
| suse_bugzilla | https://git.kernel.org/stable/c/f221033f5c24659dc6ad7e5cf18fb1b075f4a8be | https://bugzilla.suse.com/show_bug.cgi?id=1224558 |
| suse_bugzilla | https://git.kernel.org/stable/c/f976eca36cdf94e32fa4f865db0e7c427c9aa33c | https://bugzilla.suse.com/show_bug.cgi?id=1224558 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2024/CVE-2024-35989.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1224558 |
| redhat_bugzilla | https://lore.kernel.org/linux-cve-announce/2024052020-CVE-2024-35989-c5da@gregkh/T | https://bugzilla.redhat.com/show_bug.cgi?id=2281847 |
| ubuntu | https://www.cve.org/CVERecord?id=CVE-2024-35989 | https://ubuntu.com/security/CVE-2024-35989 |
| ubuntu | https://git.kernel.org/linus/f221033f5c24659dc6ad7e5cf18fb1b075f4a8be (6.9-rc6) | https://ubuntu.com/security/CVE-2024-35989 |
| ubuntu | https://git.kernel.org/stable/c/9edd3aa34d50f27b97be30b2ba4a6af0945ff56b | https://ubuntu.com/security/CVE-2024-35989 |
| ubuntu | https://git.kernel.org/stable/c/023b6390a15a98f9c3aa5e7da78d485d5384a08e | https://ubuntu.com/security/CVE-2024-35989 |
| ubuntu | https://git.kernel.org/stable/c/f976eca36cdf94e32fa4f865db0e7c427c9aa33c | https://ubuntu.com/security/CVE-2024-35989 |
| ubuntu | https://git.kernel.org/stable/c/47533176fdcef17b114a6f688bc872901c1ec6bb | https://ubuntu.com/security/CVE-2024-35989 |
| ubuntu | https://git.kernel.org/stable/c/f221033f5c24659dc6ad7e5cf18fb1b075f4a8be | https://ubuntu.com/security/CVE-2024-35989 |
| ubuntu | https://nvd.nist.gov/vuln/detail/CVE-2024-35989 | https://ubuntu.com/security/CVE-2024-35989 |
| ubuntu | https://launchpad.net/bugs/cve/CVE-2024-35989 | https://ubuntu.com/security/CVE-2024-35989 |
| ubuntu | https://security-tracker.debian.org/tracker/CVE-2024-35989 | https://ubuntu.com/security/CVE-2024-35989 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2024-35989 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
| linux |  | https://git.kernel.org/linus/f221033f5c24659dc6ad7e5cf18fb1b075f4a8be | https://git.kernel.org/linus/81dd4d4d6178306ab31db91bdc7353d485bdafce | ubuntu |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
    In the Linux kernel, the following vulnerability has been resolved:dmaengine: idxd: Fix oops during rmmod on single-CPU platformsDuring the removal of the idxd driver, registered offline callback isinvoked as part of the clean up process. However, on systems with onlyone CPU online, no valid target is available to migrate theperf context, resulting in a kernel oops:BUG: unable to handle page fault for address: 000000000002a2b8#PF: supervisor write access in kernel mode#PF: error_code(0x0002) - not-present pagePGD 1470e1067 P4D 0Oops: 0002 [#1] PREEMPT SMP NOPTICPU: 0 PID: 20 Comm: cpuhp/0 Not tainted 6.8.0-rc6-dsa+ #57Hardware name: Intel Corporation AvenueCity/AvenueCity, BIOS BHSDCRB1.86B.2492.D03.2307181620 07/18/2023RIP: 0010:mutex_lock+0x2e/0x50...Call Trace:<TASK>__die+0x24/0x70page_fault_oops+0x82/0x160do_user_addr_fault+0x65/0x6b0__pfx___rdmsr_safe_on_cpu+0x10/0x10exc_page_fault+0x7d/0x170asm_exc_page_fault+0x26/0x30mutex_lock+0x2e/0x50mutex_lock+0x1e/0x50perf_pmu_migrate_context+0x87/0x1f0perf_event_cpu_offline+0x76/0x90 [idxd]cpuhp_invoke_callback+0xa2/0x4f0__pfx_perf_event_cpu_offline+0x10/0x10 [idxd]cpuhp_thread_fun+0x98/0x150smpboot_thread_fn+0x27/0x260smpboot_thread_fn+0x1af/0x260__pfx_smpboot_thread_fn+0x10/0x10kthread+0x103/0x140__pfx_kthread+0x10/0x10ret_from_fork+0x31/0x50__pfx_kthread+0x10/0x10ret_from_fork_asm+0x1b/0x30<TASK>Fix the issue by preventing the migration of the perf context to aninvalid target. 
 openEuler评分：
  5.5
 Vector：CVSS：2.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-22.03-LTS-SP1(5.10.0):受影响
2.openEuler-22.03-LTS-SP3(5.10.0):受影响
3.openEuler-20.03-LTS-SP4(4.19.90):不受影响
4.openEuler-22.03-LTS-SP4(5.10.0):不受影响
5.master(6.1.0):不受影响
6.openEuler-24.03-LTS(6.6.0):不受影响
7.openEuler-24.03-LTS-Next(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP4(4.19.90):否
2.openEuler-22.03-LTS-SP1(5.10.0):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.master(6.1.0):否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-22.03-LTS-SP4(5.10.0):否

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2024-1838

src-openEuler/kernel
Closed

Content Risk Flag

Comments (32)

src-openEuler/kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2024-35989

Comments (32)

Search

src-openEuler/kernel
Closed