CVE-2023-52705

一、漏洞信息
 漏洞编号：[CVE-2023-52705](https://nvd.nist.gov/vuln/detail/CVE-2023-52705)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.0,6.1.14,6.1.19,6.1.5,6.1.6,6.1.8,6.4.0,6.6.0
 CVSS V2.0分值：
  BaseScore：0.0 None
  Vector：CVSS：2.0/
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:nilfs2: fix underflow in second superblock position calculationsMacro NILFS_SB2_OFFSET_BYTES, which computes the position of the secondsuperblock, underflows when the argument device size is less than 4096bytes.  Therefore, when using this macro, it is necessary to check inadvance that the device size is not less than a lower limit, or at leastthat underflow does not occur.The current nilfs2 implementation lacks this check, causing out-of-boundblock access when mounting devices smaller than 4096 bytes: I/O error, dev loop0, sector 36028797018963960 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 NILFS (loop0): unable to read secondary superblock (blocksize = 1024)In addition, when trying to resize the filesystem to a size below 4096bytes, this underflow occurs in nilfs_resize_fs(), passing a huge numberof segments to nilfs_sufile_resize(), corrupting parameters such as thenumber of segments in superblocks.  This causes excessive loop iterationsin nilfs_sufile_resize() during a subsequent resize ioctl, causingsemaphore ns_segctor_sem to block for a long time and hang the writerthread: INFO: task segctord:5067 blocked for more than 143 seconds.      Not tainted 6.2.0-rc8-syzkaller-00015-gf6feea56f66d #0  echo 0 > /proc/sys/kernel/hung_task_timeout_secs  disables this message. task:segctord        state:D stack:23456 pid:5067  ppid:2 flags:0x00004000 Call Trace:  <TASK>  context_switch kernel/sched/core.c:5293 [inline]  __schedule+0x1409/0x43f0 kernel/sched/core.c:6606  schedule+0xc3/0x190 kernel/sched/core.c:6682  rwsem_down_write_slowpath+0xfcf/0x14a0 kernel/locking/rwsem.c:1190  nilfs_transaction_lock+0x25c/0x4f0 fs/nilfs2/segment.c:357  nilfs_segctor_thread_construct fs/nilfs2/segment.c:2486 [inline]  nilfs_segctor_thread+0x52f/0x1140 fs/nilfs2/segment.c:2570  kthread+0x270/0x300 kernel/kthread.c:376  ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308  </TASK> ... Call Trace:  <TASK>  folio_mark_accessed+0x51c/0xf00 mm/swap.c:515  __nilfs_get_page_block fs/nilfs2/page.c:42 [inline]  nilfs_grab_buffer+0x3d3/0x540 fs/nilfs2/page.c:61  nilfs_mdt_submit_block+0xd7/0x8f0 fs/nilfs2/mdt.c:121  nilfs_mdt_read_block+0xeb/0x430 fs/nilfs2/mdt.c:176  nilfs_mdt_get_block+0x12d/0xbb0 fs/nilfs2/mdt.c:251  nilfs_sufile_get_segment_usage_block fs/nilfs2/sufile.c:92 [inline]  nilfs_sufile_truncate_range fs/nilfs2/sufile.c:679 [inline]  nilfs_sufile_resize+0x7a3/0x12b0 fs/nilfs2/sufile.c:777  nilfs_resize_fs+0x20c/0xed0 fs/nilfs2/super.c:422  nilfs_ioctl_resize fs/nilfs2/ioctl.c:1033 [inline]  nilfs_ioctl+0x137c/0x2440 fs/nilfs2/ioctl.c:1301  ...This fixes these issues by inserting appropriate minimum device sizechecks or anti-underflow checks, depending on where the macro is used.
 漏洞公开时间：2024-05-22 00:15:12
 漏洞创建时间：2024-05-22 02:02:52
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2023-52705
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/0ee5ed0126a2211f7174492da2ca2c29f43755c5 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/2f7a1135b202977b82457adde7db6c390056863b |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/52844d8382cd9166d708032def8905ffc3ae550f |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/99b9402a36f0799f25feee4465bfa4b8dfa74b4d |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/a158782b56b070485d54d25fc9aaf2c8f3752205 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/a8ef5109f93cea9933bbac0455d8c18757b3fcb4 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/b96591e2c35c8b47db0ec816b5fc6cb8868000ff |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-52705 | https://bugzilla.suse.com/show_bug.cgi?id=1225480 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2023/CVE-2023-52705.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1225480 |
| suse_bugzilla | https://git.kernel.org/stable/c/2f7a1135b202977b82457adde7db6c390056863b | https://bugzilla.suse.com/show_bug.cgi?id=1225480 |
| suse_bugzilla | https://git.kernel.org/stable/c/b96591e2c35c8b47db0ec816b5fc6cb8868000ff | https://bugzilla.suse.com/show_bug.cgi?id=1225480 |
| suse_bugzilla | https://git.kernel.org/stable/c/52844d8382cd9166d708032def8905ffc3ae550f | https://bugzilla.suse.com/show_bug.cgi?id=1225480 |
| suse_bugzilla | https://git.kernel.org/stable/c/0ee5ed0126a2211f7174492da2ca2c29f43755c5 | https://bugzilla.suse.com/show_bug.cgi?id=1225480 |
| suse_bugzilla | https://git.kernel.org/stable/c/a158782b56b070485d54d25fc9aaf2c8f3752205 | https://bugzilla.suse.com/show_bug.cgi?id=1225480 |
| suse_bugzilla | https://git.kernel.org/stable/c/a8ef5109f93cea9933bbac0455d8c18757b3fcb4 | https://bugzilla.suse.com/show_bug.cgi?id=1225480 |
| suse_bugzilla | https://git.kernel.org/stable/c/99b9402a36f0799f25feee4465bfa4b8dfa74b4d | https://bugzilla.suse.com/show_bug.cgi?id=1225480 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2023-52705 | https://bugzilla.suse.com/show_bug.cgi?id=1225480 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2282613 | https://bugzilla.suse.com/show_bug.cgi?id=1225480 |
| redhat_bugzilla | https://lore.kernel.org/linux-cve-announce/2024052157-CVE-2023-52705-8468@gregkh/T | https://bugzilla.redhat.com/show_bug.cgi?id=2282613 |
| ubuntu | https://www.cve.org/CVERecord?id=CVE-2023-52705 | https://ubuntu.com/security/CVE-2023-52705 |
| ubuntu | https://git.kernel.org/linus/99b9402a36f0799f25feee4465bfa4b8dfa74b4d (6.2) | https://ubuntu.com/security/CVE-2023-52705 |
| ubuntu | https://git.kernel.org/stable/c/2f7a1135b202977b82457adde7db6c390056863b | https://ubuntu.com/security/CVE-2023-52705 |
| ubuntu | https://git.kernel.org/stable/c/b96591e2c35c8b47db0ec816b5fc6cb8868000ff | https://ubuntu.com/security/CVE-2023-52705 |
| ubuntu | https://git.kernel.org/stable/c/52844d8382cd9166d708032def8905ffc3ae550f | https://ubuntu.com/security/CVE-2023-52705 |
| ubuntu | https://git.kernel.org/stable/c/0ee5ed0126a2211f7174492da2ca2c29f43755c5 | https://ubuntu.com/security/CVE-2023-52705 |
| ubuntu | https://git.kernel.org/stable/c/a158782b56b070485d54d25fc9aaf2c8f3752205 | https://ubuntu.com/security/CVE-2023-52705 |
| ubuntu | https://git.kernel.org/stable/c/a8ef5109f93cea9933bbac0455d8c18757b3fcb4 | https://ubuntu.com/security/CVE-2023-52705 |
| ubuntu | https://git.kernel.org/stable/c/99b9402a36f0799f25feee4465bfa4b8dfa74b4d | https://ubuntu.com/security/CVE-2023-52705 |
| ubuntu | https://nvd.nist.gov/vuln/detail/CVE-2023-52705 | https://ubuntu.com/security/CVE-2023-52705 |
| ubuntu | https://launchpad.net/bugs/cve/CVE-2023-52705 | https://ubuntu.com/security/CVE-2023-52705 |
| ubuntu | https://security-tracker.debian.org/tracker/CVE-2023-52705 | https://ubuntu.com/security/CVE-2023-52705 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2023-52705 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
| linux |  | https://git.kernel.org/linus/99b9402a36f0799f25feee4465bfa4b8dfa74b4d | https://git.kernel.org/linus/1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 | ubuntu |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:nilfs2: fix underflow in second superblock position calculationsMacro NILFS_SB2_OFFSET_BYTES, which computes the position of the secondsuperblock, underflows when the argument device size is less than 4096bytes.  Therefore, when using this macro, it is necessary to check inadvance that the device size is not less than a lower limit, or at leastthat underflow does not occur.The current nilfs2 implementation lacks this check, causing out-of-boundblock access when mounting devices smaller than 4096 bytes: I/O error, dev loop0, sector 36028797018963960 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 NILFS (loop0): unable to read secondary superblock (blocksize = 1024)In addition, when trying to resize the filesystem to a size below 4096bytes, this underflow occurs in nilfs_resize_fs(), passing a huge numberof segments to nilfs_sufile_resize(), corrupting parameters such as thenumber of segments in superblocks.  This causes excessive loop iterationsin nilfs_sufile_resize() during a subsequent resize ioctl, causingsemaphore ns_segctor_sem to block for a long time and hang the writerthread: INFO: task segctord:5067 blocked for more than 143 seconds.      Not tainted 6.2.0-rc8-syzkaller-00015-gf6feea56f66d #0  echo 0 > /proc/sys/kernel/hung_task_timeout_secs  disables this message. task:segctord        state:D stack:23456 pid:5067  ppid:2 flags:0x00004000 Call Trace:  <TASK>  context_switch kernel/sched/core.c:5293 [inline]  __schedule+0x1409/0x43f0 kernel/sched/core.c:6606  schedule+0xc3/0x190 kernel/sched/core.c:6682  rwsem_down_write_slowpath+0xfcf/0x14a0 kernel/locking/rwsem.c:1190  nilfs_transaction_lock+0x25c/0x4f0 fs/nilfs2/segment.c:357  nilfs_segctor_thread_construct fs/nilfs2/segment.c:2486 [inline]  nilfs_segctor_thread+0x52f/0x1140 fs/nilfs2/segment.c:2570  kthread+0x270/0x300 kernel/kthread.c:376  ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308  </TASK> ... Call Trace:  <TASK>  folio_mark_accessed+0x51c/0xf00 mm/swap.c:515  __nilfs_get_page_block fs/nilfs2/page.c:42 [inline]  nilfs_grab_buffer+0x3d3/0x540 fs/nilfs2/page.c:61  nilfs_mdt_submit_block+0xd7/0x8f0 fs/nilfs2/mdt.c:121  nilfs_mdt_read_block+0xeb/0x430 fs/nilfs2/mdt.c:176  nilfs_mdt_get_block+0x12d/0xbb0 fs/nilfs2/mdt.c:251  nilfs_sufile_get_segment_usage_block fs/nilfs2/sufile.c:92 [inline]  nilfs_sufile_truncate_range fs/nilfs2/sufile.c:679 [inline]  nilfs_sufile_resize+0x7a3/0x12b0 fs/nilfs2/sufile.c:777  nilfs_resize_fs+0x20c/0xed0 fs/nilfs2/super.c:422  nilfs_ioctl_resize fs/nilfs2/ioctl.c:1033 [inline]  nilfs_ioctl+0x137c/0x2440 fs/nilfs2/ioctl.c:1301  ...This fixes these issues by inserting appropriate minimum device sizechecks or anti-underflow checks, depending on where the macro is used.
 openEuler评分：
  5.5
 Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP4(4.19.90):受影响
2.openEuler-22.03-LTS-SP1(5.10.0):受影响
3.openEuler-22.03-LTS-SP3(5.10.0):不受影响
4.openEuler-22.03-LTS-SP4(5.10.0):不受影响
5.master(6.6.0):不受影响
6.openEuler-24.03-LTS(6.6.0):不受影响
7.openEuler-24.03-LTS-Next(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP4(4.19.90):否
2.openEuler-22.03-LTS-SP1(5.10.0):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.master(6.6.0):否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-22.03-LTS-SP4(5.10.0):否

src-openEuler/kernel

内容风险标识

评论 (52)

src-openEuler/kernel .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2023-52705

评论 (52)

搜索帮助

src-openEuler/kernel