一、漏洞信息
漏洞编号：CVE-2024-39486
漏洞归属组件：kernel
漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.0,6.1.14,6.1.19,6.1.5,6.1.6,6.1.8,6.4.0,6.6.0
CVSS V2.0分值：
BaseScore：0.0 None
Vector：CVSS：2.0/
漏洞简述：
In the Linux kernel, the following vulnerability has been resolved:drm/drm_file: Fix pid refcounting racefilp->pid is supposed to be a refcounted pointer; however, before thispatch, drm_file_update_pid() only increments the refcount of a structpid after storing a pointer to it in filp->pid and dropping thedev->filelist_mutex, making the following race possible:process A process B========= ========= begin drm_file_update_pid mutex_lock(&dev->filelist_mutex) rcu_replace_pointer(filp->pid, , 1) mutex_unlock(&dev->filelist_mutex)begin drm_file_update_pidmutex_lock(&dev->filelist_mutex)rcu_replace_pointer(filp->pid, , 1)mutex_unlock(&dev->filelist_mutex)get_pid()synchronize_rcu()put_pid() *** pid B reaches refcount 0 and is freed here *** get_pid() *** UAF *** synchronize_rcu() put_pid()As far as I know, this race can only occur with CONFIG_PREEMPT_RCU=ybecause it requires RCU to detect a quiescent state in code that is notexplicitly calling into the scheduler.This race leads to use-after-free of a struct pid .It is probably somewhat hard to hit because process A has to passthrough a synchronize_rcu() operation while process B is betweenmutex_unlock() and get_pid().Fix it by ensuring that by the time a pointer to the current task s pidis stored in the file, an extra reference to the pid has been taken.This fix also removes the condition for synchronize_rcu(); I thinkthat optimization is unnecessary complexity, since in that case wewould usually have bailed out on the lockless check above.
漏洞公开时间：2024-07-06 18:15:03
漏洞创建时间：2024-07-07 17:43:04
漏洞详情参考链接：
https://nvd.nist.gov/vuln/detail/CVE-2024-39486

漏洞分析指导链接：
https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
漏洞数据来源:
openBrain开源漏洞感知系统
漏洞补丁信息：

二、漏洞分析结构反馈
影响性分析说明：

openEuler评分：

受影响版本排查(受影响/不受影响)：
1.master(6.1.0):
2.openEuler-20.03-LTS-SP4(4.19.90):
3.openEuler-22.03-LTS-SP1(5.10.0):
4.openEuler-22.03-LTS-SP3(5.10.0):
5.openEuler-22.03-LTS-SP4(5.10.0):
6.openEuler-24.03-LTS(6.6.0):
7.openEuler-24.03-LTS-Next(6.6.0):

修复是否涉及abi变化(是/否)：
1.master(6.1.0):
2.openEuler-20.03-LTS-SP4(4.19.90):
3.openEuler-22.03-LTS-SP1(5.10.0):
4.openEuler-22.03-LTS-SP3(5.10.0):
5.openEuler-22.03-LTS-SP4(5.10.0):
6.openEuler-24.03-LTS(6.6.0):
7.openEuler-24.03-LTS-Next(6.6.0):