CVE-2024-36928

一、漏洞信息
 漏洞编号：[CVE-2024-36928](https://nvd.nist.gov/vuln/detail/CVE-2024-36928)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.0,6.1.14,6.1.19,6.1.5,6.1.6,6.1.8,6.4.0,6.6.0
 CVSS V2.0分值：
  BaseScore：0.0 None
  Vector：CVSS：2.0/
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:s390/qeth: Fix kernel panic after setting hsuidSymptom:When the hsuid attribute is set for the first time on an IQD Layer3device while the corresponding network interface is already UP,the kernel will try to execute a napi function pointer that is NULL.Example:---------------------------------------------------------------------------[ 2057.572696] illegal operation: 0001 ilc:1 [#1] SMP[ 2057.572702] Modules linked in: af_iucv qeth_l3 zfcp scsi_transport_fc sunrpc nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6nft_reject nft_ct nf_tables_set nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nf_tables libcrc32c nfnetlink ghash_s390 prng xts aes_s390 des_s390 des_generic sha3_512_s390 sha3_256_s390 sha512_s390 vfio_ccw vfio_mdev mdev vfio_iommu_type1 eadm_sch vfio ext4 mbcache jbd2 qeth_l2 bridge stp llc dasd_eckd_mod qeth dasd_mod qdio ccwgroup pkey zcrypt[ 2057.572739] CPU: 6 PID: 60182 Comm: stress_client Kdump: loaded Not tainted 4.18.0-541.el8.s390x #1[ 2057.572742] Hardware name: IBM 3931 A01 704 (LPAR)[ 2057.572744] Krnl PSW : 0704f00180000000 0000000000000002 (0x2)[ 2057.572748]            R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:3 CC:3 PM:0 RI:0 EA:3[ 2057.572751] Krnl GPRS: 0000000000000004 0000000000000000 00000000a3b008d8 0000000000000000[ 2057.572754]            00000000a3b008d8 cb923a29c779abc5 0000000000000000 00000000814cfd80[ 2057.572756]            000000000000012c 0000000000000000 00000000a3b008d8 00000000a3b008d8[ 2057.572758]            00000000bab6d500 00000000814cfd80 0000000091317e46 00000000814cfc68[ 2057.572762] Krnl Code:#0000000000000000: 0000                illegal                         >0000000000000002: 0000                illegal                          0000000000000004: 0000                illegal                          0000000000000006: 0000                illegal                          0000000000000008: 0000                illegal                          000000000000000a: 0000                illegal                          000000000000000c: 0000                illegal                          000000000000000e: 0000                illegal[ 2057.572800] Call Trace:[ 2057.572801] ([<00000000ec639700>] 0xec639700)[ 2057.572803]  [<00000000913183e2>] net_rx_action+0x2ba/0x398[ 2057.572809]  [<0000000091515f76>] __do_softirq+0x11e/0x3a0[ 2057.572813]  [<0000000090ce160c>] do_softirq_own_stack+0x3c/0x58[ 2057.572817] ([<0000000090d2cbd6>] do_softirq.part.1+0x56/0x60)[ 2057.572822]  [<0000000090d2cc60>] __local_bh_enable_ip+0x80/0x98[ 2057.572825]  [<0000000091314706>] __dev_queue_xmit+0x2be/0xd70[ 2057.572827]  [<000003ff803dd6d6>] afiucv_hs_send+0x24e/0x300 [af_iucv][ 2057.572830]  [<000003ff803dd88a>] iucv_send_ctrl+0x102/0x138 [af_iucv][ 2057.572833]  [<000003ff803de72a>] iucv_sock_connect+0x37a/0x468 [af_iucv][ 2057.572835]  [<00000000912e7e90>] __sys_connect+0xa0/0xd8[ 2057.572839]  [<00000000912e9580>] sys_socketcall+0x228/0x348[ 2057.572841]  [<0000000091514e1a>] system_call+0x2a6/0x2c8[ 2057.572843] Last Breaking-Event-Address:[ 2057.572844]  [<0000000091317e44>] __napi_poll+0x4c/0x1d8[ 2057.572846][ 2057.572847] Kernel panic - not syncing: Fatal exception in interrupt-------------------------------------------------------------------------------------------Analysis:There is one napi structure per out_q: card->qdio.out_qs[i].napiThe napi.poll functions are set during qeth_open().Sincecommit 1cfef80d4c2b ( s390/qeth: Don t call dev_close/dev_open (DOWN/UP) )qeth_set_offline()/qeth_set_online() no longer call dev_close()/dev_open(). So if qeth_free_qdio_queues() clearedcard->qdio.out_qs[i].napi.poll while the network interface was UP and thecard was offline, they are not set again.Reproduction:chzdev -e $devno layer2=0ip link set dev $network_interface upecho 0 > /sys/bus/ccw---truncated---
 漏洞公开时间：2024-05-31 00:15:16
 漏洞创建时间：2024-05-31 08:35:13
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2024-36928
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/10cb803aff3b11fe0bd5f274fc1c231a43e88df6 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/8792b557eb50b986f2496156d486d0c7c85a1524 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/8a2e4d37afb8500b276e5ee903dee06f50ab0494 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/e28dd1e1bf3ebb52cdb877fb359e8978a51576e3 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/eae0aec245712c52a3ce9c05575b541a9eef5282 |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-36928 | https://bugzilla.suse.com/show_bug.cgi?id=1225775 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2024/CVE-2024-36928.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1225775 |
| suse_bugzilla | https://git.kernel.org/stable/c/8792b557eb50b986f2496156d486d0c7c85a1524 | https://bugzilla.suse.com/show_bug.cgi?id=1225775 |
| suse_bugzilla | https://git.kernel.org/stable/c/10cb803aff3b11fe0bd5f274fc1c231a43e88df6 | https://bugzilla.suse.com/show_bug.cgi?id=1225775 |
| suse_bugzilla | https://git.kernel.org/stable/c/e28dd1e1bf3ebb52cdb877fb359e8978a51576e3 | https://bugzilla.suse.com/show_bug.cgi?id=1225775 |
| suse_bugzilla | https://git.kernel.org/stable/c/eae0aec245712c52a3ce9c05575b541a9eef5282 | https://bugzilla.suse.com/show_bug.cgi?id=1225775 |
| suse_bugzilla | https://git.kernel.org/stable/c/8a2e4d37afb8500b276e5ee903dee06f50ab0494 | https://bugzilla.suse.com/show_bug.cgi?id=1225775 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2024-36928 | https://bugzilla.suse.com/show_bug.cgi?id=1225775 |
| redhat_bugzilla | https://lore.kernel.org/linux-cve-announce/2024053041-CVE-2024-36928-845b@gregkh/T | https://bugzilla.redhat.com/show_bug.cgi?id=2284498 |
| ubuntu | https://www.cve.org/CVERecord?id=CVE-2024-36928 | https://ubuntu.com/security/CVE-2024-36928 |
| ubuntu | https://git.kernel.org/linus/8a2e4d37afb8500b276e5ee903dee06f50ab0494 (6.9-rc7) | https://ubuntu.com/security/CVE-2024-36928 |
| ubuntu | https://git.kernel.org/stable/c/8792b557eb50b986f2496156d486d0c7c85a1524 | https://ubuntu.com/security/CVE-2024-36928 |
| ubuntu | https://git.kernel.org/stable/c/10cb803aff3b11fe0bd5f274fc1c231a43e88df6 | https://ubuntu.com/security/CVE-2024-36928 |
| ubuntu | https://git.kernel.org/stable/c/e28dd1e1bf3ebb52cdb877fb359e8978a51576e3 | https://ubuntu.com/security/CVE-2024-36928 |
| ubuntu | https://git.kernel.org/stable/c/eae0aec245712c52a3ce9c05575b541a9eef5282 | https://ubuntu.com/security/CVE-2024-36928 |
| ubuntu | https://git.kernel.org/stable/c/8a2e4d37afb8500b276e5ee903dee06f50ab0494 | https://ubuntu.com/security/CVE-2024-36928 |
| ubuntu | https://nvd.nist.gov/vuln/detail/CVE-2024-36928 | https://ubuntu.com/security/CVE-2024-36928 |
| ubuntu | https://launchpad.net/bugs/cve/CVE-2024-36928 | https://ubuntu.com/security/CVE-2024-36928 |
| ubuntu | https://security-tracker.debian.org/tracker/CVE-2024-36928 | https://ubuntu.com/security/CVE-2024-36928 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2024-36928 |
| amazon_linux_explore | https://access.redhat.com/security/cve/CVE-2024-36928 | https://explore.alas.aws.amazon.com/CVE-2024-36928.html |
| amazon_linux_explore | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-36928 | https://explore.alas.aws.amazon.com/CVE-2024-36928.html |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
| linux |  | https://git.kernel.org/linus/8a2e4d37afb8500b276e5ee903dee06f50ab0494 | https://git.kernel.org/linus/1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 | ubuntu |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:s390/qeth: Fix kernel panic after setting hsuidSymptom:When the hsuid attribute is set for the first time on an IQD Layer3device while the corresponding network interface is already UP,the kernel will try to execute a napi function pointer that is NULL.Example:---------------------------------------------------------------------------[ 2057.572696] illegal operation: 0001 ilc:1 [#1] SMP[ 2057.572702] Modules linked in: af_iucv qeth_l3 zfcp scsi_transport_fc sunrpc nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6nft_reject nft_ct nf_tables_set nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nf_tables libcrc32c nfnetlink ghash_s390 prng xts aes_s390 des_s390 des_generic sha3_512_s390 sha3_256_s390 sha512_s390 vfio_ccw vfio_mdev mdev vfio_iommu_type1 eadm_sch vfio ext4 mbcache jbd2 qeth_l2 bridge stp llc dasd_eckd_mod qeth dasd_mod qdio ccwgroup pkey zcrypt[ 2057.572739] CPU: 6 PID: 60182 Comm: stress_client Kdump: loaded Not tainted 4.18.0-541.el8.s390x #1[ 2057.572742] Hardware name: IBM 3931 A01 704 (LPAR)[ 2057.572744] Krnl PSW : 0704f00180000000 0000000000000002 (0x2)[ 2057.572748]            R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:3 CC:3 PM:0 RI:0 EA:3[ 2057.572751] Krnl GPRS: 0000000000000004 0000000000000000 00000000a3b008d8 0000000000000000[ 2057.572754]            00000000a3b008d8 cb923a29c779abc5 0000000000000000 00000000814cfd80[ 2057.572756]            000000000000012c 0000000000000000 00000000a3b008d8 00000000a3b008d8[ 2057.572758]            00000000bab6d500 00000000814cfd80 0000000091317e46 00000000814cfc68[ 2057.572762] Krnl Code:#0000000000000000: 0000                illegal                         >0000000000000002: 0000                illegal                          0000000000000004: 0000                illegal                          0000000000000006: 0000                illegal                          0000000000000008: 0000                illegal                          000000000000000a: 0000                illegal                          000000000000000c: 0000                illegal                          000000000000000e: 0000                illegal[ 2057.572800] Call Trace:[ 2057.572801] ([<00000000ec639700>] 0xec639700)[ 2057.572803]  [<00000000913183e2>] net_rx_action+0x2ba/0x398[ 2057.572809]  [<0000000091515f76>] __do_softirq+0x11e/0x3a0[ 2057.572813]  [<0000000090ce160c>] do_softirq_own_stack+0x3c/0x58[ 2057.572817] ([<0000000090d2cbd6>] do_softirq.part.1+0x56/0x60)[ 2057.572822]  [<0000000090d2cc60>] __local_bh_enable_ip+0x80/0x98[ 2057.572825]  [<0000000091314706>] __dev_queue_xmit+0x2be/0xd70[ 2057.572827]  [<000003ff803dd6d6>] afiucv_hs_send+0x24e/0x300 [af_iucv][ 2057.572830]  [<000003ff803dd88a>] iucv_send_ctrl+0x102/0x138 [af_iucv][ 2057.572833]  [<000003ff803de72a>] iucv_sock_connect+0x37a/0x468 [af_iucv][ 2057.572835]  [<00000000912e7e90>] __sys_connect+0xa0/0xd8[ 2057.572839]  [<00000000912e9580>] sys_socketcall+0x228/0x348[ 2057.572841]  [<0000000091514e1a>] system_call+0x2a6/0x2c8[ 2057.572843] Last Breaking-Event-Address:[ 2057.572844]  [<0000000091317e44>] __napi_poll+0x4c/0x1d8[ 2057.572846][ 2057.572847] Kernel panic - not syncing: Fatal exception in interrupt-------------------------------------------------------------------------------------------Analysis:There is one napi structure per out_q: card->qdio.out_qs[i].napiThe napi.poll functions are set during qeth_open().Sincecommit 1cfef80d4c2b ( s390/qeth: Don t call dev_close/dev_open (DOWN/UP) )qeth_set_offline()/qeth_set_online() no longer call dev_close()/dev_open(). So if qeth_free_qdio_queues() clearedcard->qdio.out_qs[i].napi.poll while the network interface was UP and thecard was offline, they are not set again.Reproduction:chzdev -e $devno layer2=0ip link set dev $network_interface upecho 0 > /sys/bus/ccw---truncated---
 openEuler评分：
  4.4
 Vector：CVSS：3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-22.03-LTS-SP1(5.10.0):受影响
2.openEuler-22.03-LTS-SP3(5.10.0):受影响
3.openEuler-24.03-LTS(6.6.0):受影响
4.openEuler-20.03-LTS-SP4(4.19.90):不受影响
5.openEuler-22.03-LTS-SP4(5.10.0):不受影响
6.master(6.1.0):不受影响
7.openEuler-24.03-LTS-Next(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP4(4.19.90):否
2.openEuler-22.03-LTS-SP1(5.10.0):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.master(6.1.0):否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-22.03-LTS-SP4(5.10.0):否

src-openEuler/kernel

Content Risk Flag

Comments (55)

src-openEuler/kernel .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2024-36928

Comments (55)

Search

src-openEuler/kernel