CVE-2024-36894

一、漏洞信息
 漏洞编号：[CVE-2024-36894](https://nvd.nist.gov/vuln/detail/CVE-2024-36894)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.0,6.1.14,6.1.19,6.1.5,6.1.6,6.1.8,6.4.0,6.6.0
 CVSS V2.0分值：
  BaseScore：0.0 None
  Vector：CVSS：2.0/
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:usb: gadget: f_fs: Fix race between aio_cancel() and AIO request completeFFS based applications can utilize the aio_cancel() callback to dequeuepending USB requests submitted to the UDC.  There is a scenario where theFFS application issues an AIO cancel call, while the UDC is handling asoft disconnect.  For a DWC3 based implementation, the callstack lookslike the following:    DWC3 Gadget                               FFS Applicationdwc3_gadget_soft_disconnect()              ...  --> dwc3_stop_active_transfers()    --> dwc3_gadget_giveback(-ESHUTDOWN)      --> ffs_epfile_async_io_complete()   ffs_aio_cancel()        --> usb_ep_free_request()            --> usb_ep_dequeue()There is currently no locking implemented between the AIO completionhandler and AIO cancel, so the issue occurs if the completion routine isrunning in parallel to an AIO cancel call coming from the FFS application.As the completion call frees the USB request (io_data->req) the FFSapplication is also referencing it for the usb_ep_dequeue() call.  This canlead to accessing a stale/hanging pointer.commit b566d38857fc ( usb: gadget: f_fs: use io_data->status consistently )relocated the usb_ep_free_request() into ffs_epfile_async_io_complete().However, in order to properly implement locking to mitigate this issue, thespinlock can t be added to ffs_epfile_async_io_complete(), asusb_ep_dequeue() (if successfully dequeuing a USB request) will call thefunction driver s completion handler in the same context.  Hence, leadinginto a deadlock.Fix this issue by moving the usb_ep_free_request() back toffs_user_copy_worker(), and ensuring that it explicitly sets io_data->reqto NULL after freeing it within the ffs->eps_lock.  This resolves the racecondition above, as the ffs_aio_cancel() routine will not continueattempting to dequeue a request that has already been freed, or theffs_user_copy_work() not freeing the USB request until the AIO cancel isdone referencing it.This fix depends on  commit b566d38857fc ( usb: gadget: f_fs: use io_data->status  consistently )
 漏洞公开时间：2024-05-31 00:15:12
 漏洞创建时间：2024-05-31 04:53:17
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2024-36894
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/24729b307eefcd7c476065cd7351c1a018082c19 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/3613e5023f09b3308545e9d1acda86017ebd418a |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/73c05ad46bb4fbbdb346004651576d1c8dbcffbb |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/9e72ef59cbe61cd1243857a6418ca92104275867 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/a0fdccb1c9e027e3195f947f61aa87d6d0d2ea14 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/d7461830823242702f5d84084bcccb25159003f4 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/e500b1c4e29ad0bd1c1332a1eaea2913627a92dd |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/f71a53148ce34898fef099b75386a3a9f4449311 |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-36894 | https://bugzilla.suse.com/show_bug.cgi?id=1225749 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2024/CVE-2024-36894.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1225749 |
| suse_bugzilla | https://git.kernel.org/stable/c/73c05ad46bb4fbbdb346004651576d1c8dbcffbb | https://bugzilla.suse.com/show_bug.cgi?id=1225749 |
| suse_bugzilla | https://git.kernel.org/stable/c/d7461830823242702f5d84084bcccb25159003f4 | https://bugzilla.suse.com/show_bug.cgi?id=1225749 |
| suse_bugzilla | https://git.kernel.org/stable/c/24729b307eefcd7c476065cd7351c1a018082c19 | https://bugzilla.suse.com/show_bug.cgi?id=1225749 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2024-36894 | https://bugzilla.suse.com/show_bug.cgi?id=1225749 |
| redhat_bugzilla | https://lore.kernel.org/linux-cve-announce/2024053034-CVE-2024-36894-b44b@gregkh/T | https://bugzilla.redhat.com/show_bug.cgi?id=2284561 |
| ubuntu | https://www.cve.org/CVERecord?id=CVE-2024-36894 | https://ubuntu.com/security/CVE-2024-36894 |
| ubuntu | https://git.kernel.org/linus/24729b307eefcd7c476065cd7351c1a018082c19 (6.9-rc7) | https://ubuntu.com/security/CVE-2024-36894 |
| ubuntu | https://git.kernel.org/stable/c/73c05ad46bb4fbbdb346004651576d1c8dbcffbb | https://ubuntu.com/security/CVE-2024-36894 |
| ubuntu | https://git.kernel.org/stable/c/d7461830823242702f5d84084bcccb25159003f4 | https://ubuntu.com/security/CVE-2024-36894 |
| ubuntu | https://git.kernel.org/stable/c/24729b307eefcd7c476065cd7351c1a018082c19 | https://ubuntu.com/security/CVE-2024-36894 |
| ubuntu | https://ubuntu.com/security/notices/USN-6949-1 | https://ubuntu.com/security/CVE-2024-36894 |
| ubuntu | https://ubuntu.com/security/notices/USN-6952-1 | https://ubuntu.com/security/CVE-2024-36894 |
| ubuntu | https://ubuntu.com/security/notices/USN-6955-1 | https://ubuntu.com/security/CVE-2024-36894 |
| ubuntu | https://ubuntu.com/security/notices/USN-6949-2 | https://ubuntu.com/security/CVE-2024-36894 |
| ubuntu | https://ubuntu.com/security/notices/USN-6952-2 | https://ubuntu.com/security/CVE-2024-36894 |
| ubuntu | https://nvd.nist.gov/vuln/detail/CVE-2024-36894 | https://ubuntu.com/security/CVE-2024-36894 |
| ubuntu | https://launchpad.net/bugs/cve/CVE-2024-36894 | https://ubuntu.com/security/CVE-2024-36894 |
| ubuntu | https://security-tracker.debian.org/tracker/CVE-2024-36894 | https://ubuntu.com/security/CVE-2024-36894 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2024-36894 |
| mageia |  | http://advisories.mageia.org/MGASA-2024-0263.html |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
| linux |  | https://git.kernel.org/linus/24729b307eefcd7c476065cd7351c1a018082c19 | https://git.kernel.org/linus/2e4c7553cd6f9c68bb741582dcb614edcbeca70f | ubuntu |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
          Reserved.    
 openEuler评分：
  3.9
 Vector：CVSS：2.0/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP4(4.19.90):受影响
2.openEuler-22.03-LTS-SP1(5.10.0):受影响
3.openEuler-22.03-LTS-SP3(5.10.0):受影响
4.openEuler-24.03-LTS(6.6.0):受影响
5.openEuler-22.03-LTS-SP4(5.10.0):不受影响
6.master(6.6.0):不受影响
7.openEuler-24.03-LTS-Next(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP4(4.19.90):否
2.openEuler-22.03-LTS-SP1(5.10.0):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.master(6.6.0):否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-22.03-LTS-SP4(5.10.0):否

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2024-2296

src-openEuler / kernel
Closed

Content Risk Flag

Comments (48)

src-openEuler / kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2024-36894

Comments (48)

Search

src-openEuler / kernel
Closed