一、漏洞信息

漏洞编号：[CVE-2024-39486](https://nvd.nist.gov/vuln/detail/CVE-2024-39486)

漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)

漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.0,6.1.14,6.1.19,6.1.5,6.1.6,6.1.8,6.4.0,6.6.0

CVSS V2.0分值：

BaseScore：0.0 None

Vector：CVSS：2.0/

漏洞简述：

In the Linux kernel, the following vulnerability has been resolved:drm/drm_file: Fix pid refcounting racefilp->pid is supposed to be a refcounted pointer; however, before thispatch, drm_file_update_pid() only increments the refcount of a structpid after storing a pointer to it in filp->pid and dropping thedev->filelist_mutex, making the following race possible:process A process B========= ========= begin drm_file_update_pid mutex_lock(&dev->filelist_mutex) rcu_replace_pointer(filp->pid, <pid B>, 1) mutex_unlock(&dev->filelist_mutex)begin drm_file_update_pidmutex_lock(&dev->filelist_mutex)rcu_replace_pointer(filp->pid, <pid A>, 1)mutex_unlock(&dev->filelist_mutex)get_pid(<pid A>)synchronize_rcu()put_pid(<pid B>) *** pid B reaches refcount 0 and is freed here *** get_pid(<pid B>) *** UAF *** synchronize_rcu() put_pid(<pid A>)As far as I know, this race can only occur with CONFIG_PREEMPT_RCU=ybecause it requires RCU to detect a quiescent state in code that is notexplicitly calling into the scheduler.This race leads to use-after-free of a struct pid .It is probably somewhat hard to hit because process A has to passthrough a synchronize_rcu() operation while process B is betweenmutex_unlock() and get_pid().Fix it by ensuring that by the time a pointer to the current task s pidis stored in the file, an extra reference to the pid has been taken.This fix also removes the condition for synchronize_rcu(); I thinkthat optimization is unnecessary complexity, since in that case wewould usually have bailed out on the lockless check above.

漏洞公开时间：2024-07-06 18:15:03

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2024-39486

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/0acce2a5c619ef1abdee783d7fea5eac78ce4844 | |

| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/16682588ead4a593cf1aebb33b36df4d1e9e4ffa | |

| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/4f2a129b33a2054e62273edd5a051c34c08d96e9 | |

| cve_search | | https://git.kernel.org/stable/c/16682588ead4a593cf1aebb33b36df4d1e9e4ffa |

| cve_search | | https://git.kernel.org/stable/c/0acce2a5c619ef1abdee783d7fea5eac78ce4844 |

| cve_search | | https://git.kernel.org/stable/c/4f2a129b33a2054e62273edd5a051c34c08d96e9 |

</details>

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

openBrain开源漏洞感知系统

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

无

</details>

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

受影响版本排查(受影响/不受影响)：

1.master(6.1.0):

2.openEuler-20.03-LTS-SP4(4.19.90):

3.openEuler-22.03-LTS-SP1(5.10.0):

4.openEuler-22.03-LTS-SP3(5.10.0):

5.openEuler-22.03-LTS-SP4(5.10.0):

6.openEuler-24.03-LTS(6.6.0):

7.openEuler-24.03-LTS-Next(6.6.0):

修复是否涉及abi变化(是/否)：

1.master(6.1.0):

2.openEuler-20.03-LTS-SP4(4.19.90):

3.openEuler-22.03-LTS-SP1(5.10.0):

4.openEuler-22.03-LTS-SP3(5.10.0):

5.openEuler-22.03-LTS-SP4(5.10.0):

6.openEuler-24.03-LTS(6.6.0):

7.openEuler-24.03-LTS-Next(6.6.0):