CVE-2024-40927

一、漏洞信息
 漏洞编号：[CVE-2024-40927](https://nvd.nist.gov/vuln/detail/CVE-2024-40927)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.0,6.1.14,6.1.19,6.1.5,6.1.6,6.1.8,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：0.0 None
  Vector：CVSS：3.0/
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:xhci: Handle TD clearing for multiple streams caseWhen multiple streams are in use, multiple TDs might be in flight whenan endpoint is stopped. We need to issue a Set TR Dequeue Pointer foreach, to ensure everything is reset properly and the caches cleared.Change the logic so that any N>1 TDs found active for different streamsare deferred until after the first one is processed, callingxhci_invalidate_cancelled_tds() again from xhci_handle_cmd_set_deq() toqueue another command until we are done with all of them. Also changethe error/ should never happen  paths to ensure we at least clear anyaffected TDs, even if we can t issue a command to clear the hardwarecache, and complain loudly with an xhci_warn() if this ever happens.This problem case dates back to commit e9df17eb1408 ( USB: xhci: Correctassumptions about number of rings per endpoint. ) early on in the XHCIdriver s life, when stream support was first added.It was then identified but not fixed nor made into a warning in commit674f8438c121 ( xhci: split handling halted endpoints into two steps ),which added a FIXME comment for the problem case (without materiallychanging the behavior as far as I can tell, though the new logic madethe problem more obvious).Then later, in commit 94f339147fc3 ( xhci: Fix failure to give back somecached cancelled URBs. ), it was acknowledged again.[Mathias: commit 94f339147fc3 ( xhci: Fix failure to give back some cachedcancelled URBs. ) was a targeted regression fix to the previously mentionedpatch. Users reported issues with usb stuck after unmounting/disconnectingUAS devices. This rolled back the TD clearing of multiple streams to itsoriginal state.]Apparently the commit author was aware of the problem (yet still choseto submit it): It was still mentioned as a FIXME, an xhci_dbg() wasadded to log the problem condition, and the remaining issue was mentionedin the commit description. The choice of making the log type xhci_dbg()for what is, at this point, a completely unhandled and known brokencondition is puzzling and unfortunate, as it guarantees that no actualusers would see the log in production, thereby making it nighundebuggable (indeed, even if you turn on DEBUG, the message doesn treally hint at there being a problem at all).It took me *months* of random xHC crashes to finally find a reliablerepro and be able to do a deep dive debug session, which could all havebeen avoided had this unhandled, broken condition been actually reportedwith a warning, as it should have been as a bug intentionally left inunfixed (never mind that it shouldn t have been left in at all).> Another fix to solve clearing the caches of all stream rings with> cancelled TDs is needed, but not as urgent.3 years after that statement and 14 years after the original bug wasintroduced, I think it s finally time to fix it. And maybe next timelet s not leave bugs unfixed (that are actually worse than the originalbug), and let s actually get people to review kernel commits please.Fixes xHC crashes and IOMMU faults with UAS devices when handlingerrors/faults. Easiest repro is to use `hdparm` to mark an early sector(e.g. 1024) on a disk as bad, then `cat /dev/sdX > /dev/null` in a loop.At least in the case of JMicron controllers, the read errors end uphaving to cancel two TDs (for two queued requests to different streams)and the one that didn t get cleared properly ends up faulting the xHCentirely when it tries to access DMA pages that have since been unmapped,referred to by the stale TDs. This normally happens quickly (after twoor three loops). After this fix, I left the `cat` in a loop runningovernight and experienced no xHC failures, with all read errorsrecovered properly. Repro d and tested on an Apple M1 Mac Mini(dwc3 host).On systems without an IOMMU, this bug would instead silently corruptfreed memory, making this a---truncated---
 漏洞公开时间：2024-07-12 21:15:15
 漏洞创建时间：2024-07-14 23:57:54
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2024-40927
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/26460c1afa311524f588e288a4941432f0de6228 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/5ceac4402f5d975e5a01c806438eb4e554771577 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/61593dc413c3655e4328a351555235bc3089486a |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/633f72cb6124ecda97b641fbc119340bd88d51a9 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/949be4ec5835e0ccb3e2a8ab0e46179cb5512518 |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-40927 | https://bugzilla.suse.com/show_bug.cgi?id=1227816 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2024-40927 | https://bugzilla.suse.com/show_bug.cgi?id=1227816 |
| suse_bugzilla | https://git.kernel.org/stable/c/26460c1afa311524f588e288a4941432f0de6228 | https://bugzilla.suse.com/show_bug.cgi?id=1227816 |
| suse_bugzilla | https://git.kernel.org/stable/c/5ceac4402f5d975e5a01c806438eb4e554771577 | https://bugzilla.suse.com/show_bug.cgi?id=1227816 |
| suse_bugzilla | https://git.kernel.org/stable/c/61593dc413c3655e4328a351555235bc3089486a | https://bugzilla.suse.com/show_bug.cgi?id=1227816 |
| suse_bugzilla | https://git.kernel.org/stable/c/633f72cb6124ecda97b641fbc119340bd88d51a9 | https://bugzilla.suse.com/show_bug.cgi?id=1227816 |
| suse_bugzilla | https://git.kernel.org/stable/c/949be4ec5835e0ccb3e2a8ab0e46179cb5512518 | https://bugzilla.suse.com/show_bug.cgi?id=1227816 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2024/CVE-2024-40927.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1227816 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:5102 | https://bugzilla.redhat.com/show_bug.cgi?id=2297511 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:5101 | https://bugzilla.redhat.com/show_bug.cgi?id=2297511 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:6567 | https://bugzilla.redhat.com/show_bug.cgi?id=2297511 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2024-40927 |
| anolis |  | https://anas.openanolis.cn/cves/detail/CVE-2024-40927 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

无
</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:xhci: Handle TD clearing for multiple streams caseWhen multiple streams are in use, multiple TDs might be in flight whenan endpoint is stopped. We need to issue a Set TR Dequeue Pointer foreach, to ensure everything is reset properly and the caches cleared.Change the logic so that any N>1 TDs found active for different streamsare deferred until after the first one is processed, callingxhci_invalidate_cancelled_tds() again from xhci_handle_cmd_set_deq() toqueue another command until we are done with all of them. Also changethe error/ should never happen  paths to ensure we at least clear anyaffected TDs, even if we can t issue a command to clear the hardwarecache, and complain loudly with an xhci_warn() if this ever happens.This problem case dates back to commit e9df17eb1408 ( USB: xhci: Correctassumptions about number of rings per endpoint. ) early on in the XHCIdriver s life, when stream support was first added.It was then identified but not fixed nor made into a warning in commit674f8438c121 ( xhci: split handling halted endpoints into two steps ),which added a FIXME comment for the problem case (without materiallychanging the behavior as far as I can tell, though the new logic madethe problem more obvious).Then later, in commit 94f339147fc3 ( xhci: Fix failure to give back somecached cancelled URBs. ), it was acknowledged again.[Mathias: commit 94f339147fc3 ( xhci: Fix failure to give back some cachedcancelled URBs. ) was a targeted regression fix to the previously mentionedpatch. Users reported issues with usb stuck after unmounting/disconnectingUAS devices. This rolled back the TD clearing of multiple streams to itsoriginal state.]Apparently the commit author was aware of the problem (yet still choseto submit it): It was still mentioned as a FIXME, an xhci_dbg() wasadded to log the problem condition, and the remaining issue was mentionedin the commit description. The choice of making the log type xhci_dbg()for what is, at this point, a completely unhandled and known brokencondition is puzzling and unfortunate, as it guarantees that no actualusers would see the log in production, thereby making it nighundebuggable (indeed, even if you turn on DEBUG, the message doesn treally hint at there being a problem at all).It took me *months* of random xHC crashes to finally find a reliablerepro and be able to do a deep dive debug session, which could all havebeen avoided had this unhandled, broken condition been actually reportedwith a warning, as it should have been as a bug intentionally left inunfixed (never mind that it shouldn t have been left in at all).> Another fix to solve clearing the caches of all stream rings with> cancelled TDs is needed, but not as urgent.3 years after that statement and 14 years after the original bug wasintroduced, I think it s finally time to fix it. And maybe next timelet s not leave bugs unfixed (that are actually worse than the originalbug), and let s actually get people to review kernel commits please.Fixes xHC crashes and IOMMU faults with UAS devices when handlingerrors/faults. Easiest repro is to use `hdparm` to mark an early sector(e.g. 1024) on a disk as bad, then `cat /dev/sdX > /dev/null` in a loop.At least in the case of JMicron controllers, the read errors end uphaving to cancel two TDs (for two queued requests to different streams)and the one that didn t get cleared properly ends up faulting the xHCentirely when it tries to access DMA pages that have since been unmapped,referred to by the stale TDs. This normally happens quickly (after twoor three loops). After this fix, I left the `cat` in a loop runningovernight and experienced no xHC failures, with all read errorsrecovered properly. Repro d and tested on an Apple M1 Mac Mini(dwc3 host).On systems without an IOMMU, this bug would instead silently corruptfreed memory, making this a---truncated---
 openEuler评分：
  6.6
 Vector：CVSS：3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP4(4.19.90):受影响
2.openEuler-22.03-LTS-SP3(5.10.0):受影响
3.openEuler-22.03-LTS-SP4(5.10.0):受影响
4.openEuler-24.03-LTS(6.6.0):受影响
5.master:不受影响
6.openEuler-24.03-LTS-Next(6.6.0):不受影响
7.openEuler-24.03-LTS-SP1(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP4(4.19.90):否
2.openEuler-22.03-LTS-SP1(5.10.0):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.master:否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-22.03-LTS-SP4(5.10.0):否
8.openEuler-24.03-LTS-SP1(6.6.0):否

原因说明：
  1.openEuler-24.03-LTS(6.6.0):正常修复
2.openEuler-20.03-LTS-SP4(4.19.90):不修复-超出修复范围
3.openEuler-22.03-LTS-SP3(5.10.0):不修复-超出修复范围
4.openEuler-22.03-LTS-SP4(5.10.0):不修复-超出修复范围
5.master:不受影响-漏洞代码不能被攻击者触发
6.openEuler-24.03-LTS-Next(6.6.0):不受影响-漏洞代码不能被攻击者触发
7.openEuler-24.03-LTS-SP1(6.6.0):不受影响-漏洞代码不存在

src-openEuler/kernel

内容风险标识

评论 (29)

src-openEuler/kernel .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2024-40927

评论 (29)

搜索帮助

src-openEuler/kernel