CVE-2021-47618

一、漏洞信息
 漏洞编号：[CVE-2021-47618](https://nvd.nist.gov/vuln/detail/CVE-2021-47618)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.0,6.1.14,6.1.19,6.1.5,6.1.6,6.1.8,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：0.0 None
  Vector：CVSS：3.0/
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:ARM: 9170/1: fix panic when kasan and kprobe are enabledarm32 uses software to simulate the instruction replacedby kprobe. some instructions may be simulated by constructingassembly functions. therefore, before executing instructionsimulation, it is necessary to construct assembly functionexecution environment in C language through binding registers.after kasan is enabled, the register binding relationship willbe destroyed, resulting in instruction simulation errors andcausing kernel panic.the kprobe emulate instruction function is distributed in threefiles: actions-common.c actions-arm.c actions-thumb.c, so disableKASAN when compiling these files.for example, use kprobe insert on cap_capable+20 after kasanenabled, the cap_capable assembly code is as follows:<cap_capable>:e92d47f0	push	{r4, r5, r6, r7, r8, r9, sl, lr}e1a05000	mov	r5, r0e280006c	add	r0, r0, #108    ; 0x6ce1a04001	mov	r4, r1e1a06002	mov	r6, r2e59fa090	ldr	sl, [pc, #144]  ;ebfc7bf8	bl	c03aa4b4 <__asan_load4>e595706c	ldr	r7, [r5, #108]  ; 0x6ce2859014	add	r9, r5, #20......The emulate_ldr assembly code after enabling kasan is as follows:c06f1384 <emulate_ldr>:e92d47f0	push	{r4, r5, r6, r7, r8, r9, sl, lr}e282803c	add	r8, r2, #60     ; 0x3ce1a05000	mov	r5, r0e7e37855	ubfx	r7, r5, #16, #4e1a00008	mov	r0, r8e1a09001	mov	r9, r1e1a04002	mov	r4, r2ebf35462	bl	c03c6530 <__asan_load4>e357000f	cmp	r7, #15e7e36655	ubfx	r6, r5, #12, #4e205a00f	and	sl, r5, #150a000001	beq	c06f13bc <emulate_ldr+0x38>e0840107	add	r0, r4, r7, lsl #2ebf3545c	bl	c03c6530 <__asan_load4>e084010a	add	r0, r4, sl, lsl #2ebf3545a	bl	c03c6530 <__asan_load4>e2890010	add	r0, r9, #16ebf35458	bl	c03c6530 <__asan_load4>e5990010	ldr	r0, [r9, #16]e12fff30	blx	r0e356000f	cm	r6, #151a000014	bne	c06f1430 <emulate_ldr+0xac>e1a06000	mov	r6, r0e2840040	add	r0, r4, #64     ; 0x40......when running in emulate_ldr to simulate the ldr instruction, panicoccurred, and the log is as follows:Unable to handle kernel NULL pointer dereference at virtual address00000090pgd = ecb46400[00000090] *pgd=2e0fa003, *pmd=00000000Internal error: Oops: 206 [#1] SMP ARMPC is at cap_capable+0x14/0xb0LR is at emulate_ldr+0x50/0xc0psr: 600d0293 sp : ecd63af8  ip : 00000004  fp : c0a7c30cr10: 00000000  r9 : c30897f4  r8 : ecd63cd4r7 : 0000000f  r6 : 0000000a  r5 : e59fa090  r4 : ecd63c98r3 : c06ae294  r2 : 00000000  r1 : b7611300  r0 : bf4ec008Flags: nZCv  IRQs off  FIQs on  Mode SVC_32  ISA ARM  Segment userControl: 32c5387d  Table: 2d546400  DAC: 55555555Process bash (pid: 1643, stack limit = 0xecd60190)(cap_capable) from (kprobe_handler+0x218/0x340)(kprobe_handler) from (kprobe_trap_handler+0x24/0x48)(kprobe_trap_handler) from (do_undefinstr+0x13c/0x364)(do_undefinstr) from (__und_svc_finish+0x0/0x30)(__und_svc_finish) from (cap_capable+0x18/0xb0)(cap_capable) from (cap_vm_enough_memory+0x38/0x48)(cap_vm_enough_memory) from(security_vm_enough_memory_mm+0x48/0x6c)(security_vm_enough_memory_mm) from(copy_process.constprop.5+0x16b4/0x25c8)(copy_process.constprop.5) from (_do_fork+0xe8/0x55c)(_do_fork) from (SyS_clone+0x1c/0x24)(SyS_clone) from (__sys_trace_return+0x0/0x10)Code: 0050a0e1 6c0080e2 0140a0e1 0260a0e1 (f801f0e7)
 漏洞公开时间：2024-06-20 19:15:54
 漏洞创建时间：2024-06-20 11:47:53
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2021-47618
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/1515e72aae803fc6b466adf918e71c4e4c9d5b3d |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/8b59b0a53c840921b625378f137e88adfa87647e |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/ba1863be105b06e10d0e2f6b1b8a0570801cfc71 |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-47618 | https://bugzilla.suse.com/show_bug.cgi?id=1226644 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2021-47618 | https://bugzilla.suse.com/show_bug.cgi?id=1226644 |
| suse_bugzilla | https://git.kernel.org/stable/c/1515e72aae803fc6b466adf918e71c4e4c9d5b3d | https://bugzilla.suse.com/show_bug.cgi?id=1226644 |
| suse_bugzilla | https://git.kernel.org/stable/c/8b59b0a53c840921b625378f137e88adfa87647e | https://bugzilla.suse.com/show_bug.cgi?id=1226644 |
| suse_bugzilla | https://git.kernel.org/stable/c/ba1863be105b06e10d0e2f6b1b8a0570801cfc71 | https://bugzilla.suse.com/show_bug.cgi?id=1226644 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2021/CVE-2021-47618.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1226644 |
| redhat_bugzilla | https://lore.kernel.org/linux-cve-announce/2024062007-CVE-2021-47618-fd65@gregkh/T | https://bugzilla.redhat.com/show_bug.cgi?id=2293295 |
| ubuntu | https://www.cve.org/CVERecord?id=CVE-2021-47618 | https://ubuntu.com/security/CVE-2021-47618 |
| ubuntu | https://git.kernel.org/linus/8b59b0a53c840921b625378f137e88adfa87647e (5.17-rc2) | https://ubuntu.com/security/CVE-2021-47618 |
| ubuntu | https://git.kernel.org/stable/c/1515e72aae803fc6b466adf918e71c4e4c9d5b3d | https://ubuntu.com/security/CVE-2021-47618 |
| ubuntu | https://git.kernel.org/stable/c/ba1863be105b06e10d0e2f6b1b8a0570801cfc71 | https://ubuntu.com/security/CVE-2021-47618 |
| ubuntu | https://git.kernel.org/stable/c/8b59b0a53c840921b625378f137e88adfa87647e | https://ubuntu.com/security/CVE-2021-47618 |
| ubuntu | https://nvd.nist.gov/vuln/detail/CVE-2021-47618 | https://ubuntu.com/security/CVE-2021-47618 |
| ubuntu | https://launchpad.net/bugs/cve/CVE-2021-47618 | https://ubuntu.com/security/CVE-2021-47618 |
| ubuntu | https://security-tracker.debian.org/tracker/CVE-2021-47618 | https://ubuntu.com/security/CVE-2021-47618 |
| anolis |  | https://anas.openanolis.cn/cves/detail/CVE-2021-47618 |
| cve_search |  | https://git.kernel.org/stable/c/1515e72aae803fc6b466adf918e71c4e4c9d5b3d |
| cve_search |  | https://git.kernel.org/stable/c/ba1863be105b06e10d0e2f6b1b8a0570801cfc71 |
| cve_search |  | https://git.kernel.org/stable/c/8b59b0a53c840921b625378f137e88adfa87647e |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
| linux |  | https://git.kernel.org/linus/8b59b0a53c840921b625378f137e88adfa87647e | https://git.kernel.org/linus/35aa1df4328340f38edc46f00837f08d33d49f63 | ubuntu |
| linux |  | https://git.kernel.org/linus/8b59b0a53c840921b625378f137e88adfa87647e | https://git.kernel.org/linus/421015713b306e47af95d4d61cdfbd96d462e4cb | ubuntu |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  Reserved.
 openEuler评分：
  5.5
 Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP4(4.19.90):受影响
2.openEuler-22.03-LTS-SP3(5.10.0):受影响
3.openEuler-22.03-LTS-SP4(5.10.0):受影响
4.master(6.6.0):不受影响
5.openEuler-24.03-LTS(6.6.0):不受影响
6.openEuler-24.03-LTS-Next(6.6.0):不受影响
7.openEuler-24.03-LTS-SP1(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP4(4.19.90):否
2.openEuler-22.03-LTS-SP1(5.10.0):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.master(6.6.0):否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-22.03-LTS-SP4(5.10.0):否
8.openEuler-24.03-LTS-SP1(6.6.0):否

原因说明：
  1.openEuler-22.03-LTS-SP3(5.10.0):正常修复
2.openEuler-22.03-LTS-SP4(5.10.0):正常修复
3.openEuler-20.03-LTS-SP4(4.19.90):暂不修复-暂无解决方案或补丁
4.master(6.6.0):不受影响-漏洞代码不能被攻击者触发
5.openEuler-24.03-LTS-Next(6.6.0):不受影响-漏洞代码不能被攻击者触发
6.openEuler-24.03-LTS(6.6.0):不受影响-漏洞代码不存在
7.openEuler-24.03-LTS-SP1(6.6.0):不受影响-漏洞代码不存在

src-openEuler/kernel

内容风险标识

评论 (52)

src-openEuler/kernel .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2021-47618

评论 (52)

搜索帮助

src-openEuler/kernel