代码拉取完成，页面将自动刷新
一、漏洞信息
漏洞编号：CVE-2022-48842
漏洞归属组件：kernel
漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.0,6.1.14,6.1.19,6.1.5,6.1.6,6.1.8,6.4.0,6.6.0
CVSS V3.0分值：
BaseScore：4.7 Medium
Vector：CVSS：3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
漏洞简述：
In the Linux kernel, the following vulnerability has been resolved:ice: Fix race condition during interface enslaveCommit 5dbbbd01cbba83 ( ice: Avoid RTNL lock when re-creatingauxiliary device ) changes a process of re-creation of aux deviceso ice_plug_aux_dev() is called from ice_service_task() context.This unfortunately opens a race window that can result in dead-lockwhen interface has left LAG and immediately enters LAG again.Reproducer:#!/bin/ship link add lag0 type bond mode 1 miimon 100ip link set lag0for n in {1..10}; do echo Cycle: $n ip link set ens7f0 master lag0 sleep 1 ip link set ens7f0 nomasterdoneThis results in:[20976.208697] Workqueue: ice ice_service_task [ice][20976.213422] Call Trace:[20976.215871] __schedule+0x2d1/0x830[20976.219364] schedule+0x35/0xa0[20976.222510] schedule_preempt_disabled+0xa/0x10[20976.227043] __mutex_lock.isra.7+0x310/0x420[20976.235071] enum_all_gids_of_dev_cb+0x1c/0x100 [ib_core][20976.251215] ib_enum_roce_netdev+0xa4/0xe0 [ib_core][20976.256192] ib_cache_setup_one+0x33/0xa0 [ib_core][20976.261079] ib_register_device+0x40d/0x580 [ib_core][20976.266139] irdma_ib_register_device+0x129/0x250 [irdma][20976.281409] irdma_probe+0x2c1/0x360 [irdma][20976.285691] auxiliary_bus_probe+0x45/0x70[20976.289790] really_probe+0x1f2/0x480[20976.298509] driver_probe_device+0x49/0xc0[20976.302609] bus_for_each_drv+0x79/0xc0[20976.306448] __device_attach+0xdc/0x160[20976.310286] bus_probe_device+0x9d/0xb0[20976.314128] device_add+0x43c/0x890[20976.321287] __auxiliary_device_add+0x43/0x60[20976.325644] ice_plug_aux_dev+0xb2/0x100 [ice][20976.330109] ice_service_task+0xd0c/0xed0 [ice][20976.342591] process_one_work+0x1a7/0x360[20976.350536] worker_thread+0x30/0x390[20976.358128] kthread+0x10a/0x120[20976.365547] ret_from_fork+0x1f/0x40...[20976.438030] task:ip state:D stack: 0 pid:213658 ppid:213627 flags:0x00004084[20976.446469] Call Trace:[20976.448921] __schedule+0x2d1/0x830[20976.452414] schedule+0x35/0xa0[20976.455559] schedule_preempt_disabled+0xa/0x10[20976.460090] __mutex_lock.isra.7+0x310/0x420[20976.464364] device_del+0x36/0x3c0[20976.467772] ice_unplug_aux_dev+0x1a/0x40 [ice][20976.472313] ice_lag_event_handler+0x2a2/0x520 [ice][20976.477288] notifier_call_chain+0x47/0x70[20976.481386] __netdev_upper_dev_link+0x18b/0x280[20976.489845] bond_enslave+0xe05/0x1790 [bonding][20976.494475] do_setlink+0x336/0xf50[20976.502517] __rtnl_newlink+0x529/0x8b0[20976.543441] rtnl_newlink+0x43/0x60[20976.546934] rtnetlink_rcv_msg+0x2b1/0x360[20976.559238] netlink_rcv_skb+0x4c/0x120[20976.563079] netlink_unicast+0x196/0x230[20976.567005] netlink_sendmsg+0x204/0x3d0[20976.570930] sock_sendmsg+0x4c/0x50[20976.574423] ____sys_sendmsg+0x1eb/0x250[20976.586807] ___sys_sendmsg+0x7c/0xc0[20976.606353] __sys_sendmsg+0x57/0xa0[20976.609930] do_syscall_64+0x5b/0x1a0[20976.613598] entry_SYSCALL_64_after_hwframe+0x65/0xca1. Command ip link ... set nomaster causes that ice_plug_aux_dev() is called from ice_service_task() context, aux device is created and associated device->lock is taken.2. Command ip link ... set master... calls ice s notifier under RTNL lock and that notifier calls ice_unplug_aux_dev(). That function tries to take aux device->lock but this is already taken by ice_plug_aux_dev() in step 13. Later ice_plug_aux_dev() tries to take RTNL lock but this is already taken in step 24. Dead-lockThe patch fixes this issue by following changes:- Bit ICE_FLAG_PLUG_AUX_DEV is kept to be set during ice_plug_aux_dev() call in ice_service_task()- The bit is checked in ice_clear_rdma_cap() and only if it is not set then ice_unplug_aux_dev() is called. If it is set (in other words plugging of aux device was requested and ice_plug_aux_dev() is potentially running) then the function only clears the---truncated---
漏洞公开时间：2024-07-16 21:15:11
漏洞创建时间：2024-07-16 16:02:54
漏洞详情参考链接：
https://nvd.nist.gov/vuln/detail/CVE-2022-48842
漏洞分析指导链接：
https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
漏洞数据来源:
openBrain开源漏洞感知系统
漏洞补丁信息：
二、漏洞分析结构反馈
影响性分析说明：
In the Linux kernel, the following vulnerability has been resolved:ice: Fix race condition during interface enslaveCommit 5dbbbd01cbba83 ( ice: Avoid RTNL lock when re-creatingauxiliary device ) changes a process of re-creation of aux deviceso ice_plug_aux_dev() is called from ice_service_task() context.This unfortunately opens a race window that can result in dead-lockwhen interface has left LAG and immediately enters LAG again.Reproducer:#!/bin/ship link add lag0 type bond mode 1 miimon 100ip link set lag0for n in {1..10}; do echo Cycle: $n ip link set ens7f0 master lag0 sleep 1 ip link set ens7f0 nomasterdoneThis results in:[20976.208697] Workqueue: ice ice_service_task [ice][20976.213422] Call Trace:[20976.215871] __schedule+0x2d1/0x830[20976.219364] schedule+0x35/0xa0[20976.222510] schedule_preempt_disabled+0xa/0x10[20976.227043] __mutex_lock.isra.7+0x310/0x420[20976.235071] enum_all_gids_of_dev_cb+0x1c/0x100 [ib_core][20976.251215] ib_enum_roce_netdev+0xa4/0xe0 [ib_core][20976.256192] ib_cache_setup_one+0x33/0xa0 [ib_core][20976.261079] ib_register_device+0x40d/0x580 [ib_core][20976.266139] irdma_ib_register_device+0x129/0x250 [irdma][20976.281409] irdma_probe+0x2c1/0x360 [irdma][20976.285691] auxiliary_bus_probe+0x45/0x70[20976.289790] really_probe+0x1f2/0x480[20976.298509] driver_probe_device+0x49/0xc0[20976.302609] bus_for_each_drv+0x79/0xc0[20976.306448] __device_attach+0xdc/0x160[20976.310286] bus_probe_device+0x9d/0xb0[20976.314128] device_add+0x43c/0x890[20976.321287] __auxiliary_device_add+0x43/0x60[20976.325644] ice_plug_aux_dev+0xb2/0x100 [ice][20976.330109] ice_service_task+0xd0c/0xed0 [ice][20976.342591] process_one_work+0x1a7/0x360[20976.350536] worker_thread+0x30/0x390[20976.358128] kthread+0x10a/0x120[20976.365547] ret_from_fork+0x1f/0x40...[20976.438030] task:ip state:D stack: 0 pid:213658 ppid:213627 flags:0x00004084[20976.446469] Call Trace:[20976.448921] __schedule+0x2d1/0x830[20976.452414] schedule+0x35/0xa0[20976.455559] schedule_preempt_disabled+0xa/0x10[20976.460090] __mutex_lock.isra.7+0x310/0x420[20976.464364] device_del+0x36/0x3c0[20976.467772] ice_unplug_aux_dev+0x1a/0x40 [ice][20976.472313] ice_lag_event_handler+0x2a2/0x520 [ice][20976.477288] notifier_call_chain+0x47/0x70[20976.481386] __netdev_upper_dev_link+0x18b/0x280[20976.489845] bond_enslave+0xe05/0x1790 [bonding][20976.494475] do_setlink+0x336/0xf50[20976.502517] __rtnl_newlink+0x529/0x8b0[20976.543441] rtnl_newlink+0x43/0x60[20976.546934] rtnetlink_rcv_msg+0x2b1/0x360[20976.559238] netlink_rcv_skb+0x4c/0x120[20976.563079] netlink_unicast+0x196/0x230[20976.567005] netlink_sendmsg+0x204/0x3d0[20976.570930] sock_sendmsg+0x4c/0x50[20976.574423] ____sys_sendmsg+0x1eb/0x250[20976.586807] ___sys_sendmsg+0x7c/0xc0[20976.606353] __sys_sendmsg+0x57/0xa0[20976.609930] do_syscall_64+0x5b/0x1a0[20976.613598] entry_SYSCALL_64_after_hwframe+0x65/0xca1. Command ip link ... set nomaster causes that ice_plug_aux_dev() is called from ice_service_task() context, aux device is created and associated device->lock is taken.2. Command ip link ... set master... calls ice s notifier under RTNL lock and that notifier calls ice_unplug_aux_dev(). That function tries to take aux device->lock but this is already taken by ice_plug_aux_dev() in step 13. Later ice_plug_aux_dev() tries to take RTNL lock but this is already taken in step 24. Dead-lockThe patch fixes this issue by following changes:- Bit ICE_FLAG_PLUG_AUX_DEV is kept to be set during ice_plug_aux_dev() call in ice_service_task()- The bit is checked in ice_clear_rdma_cap() and only if it is not set then ice_unplug_aux_dev() is called. If it is set (in other words plugging of aux device was requested and ice_plug_aux_dev() is potentially running) then the function only clears the---truncated---
openEuler评分：
4.7
Vector：CVSS：3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
受影响版本排查(受影响/不受影响)：
1.openEuler-20.03-LTS-SP4(4.19.90):不受影响
2.openEuler-22.03-LTS-SP1(5.10.0):不受影响
3.openEuler-22.03-LTS-SP3(5.10.0):不受影响
4.openEuler-22.03-LTS-SP4(5.10.0):不受影响
5.master(6.6.0):不受影响
6.openEuler-24.03-LTS(6.6.0):不受影响
7.openEuler-24.03-LTS-Next(6.6.0):不受影响
8.openEuler-24.03-LTS-SP1(6.6.0):不受影响
修复是否涉及abi变化(是/否)：
1.openEuler-20.03-LTS-SP4(4.19.90):否
2.openEuler-22.03-LTS-SP1(5.10.0):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.master(6.6.0):否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-22.03-LTS-SP4(5.10.0):否
8.openEuler-24.03-LTS-SP1(6.6.0):否
原因说明：
1.openEuler-20.03-LTS-SP4(4.19.90):不受影响-漏洞代码不存在
2.openEuler-22.03-LTS-SP1(5.10.0):不受影响-漏洞代码不存在
3.openEuler-22.03-LTS-SP3(5.10.0):不受影响-漏洞代码不存在
4.openEuler-22.03-LTS-SP4(5.10.0):不受影响-漏洞代码不存在
5.master(6.6.0):不受影响-漏洞代码不存在
6.openEuler-24.03-LTS(6.6.0):不受影响-漏洞代码不存在
7.openEuler-24.03-LTS-Next(6.6.0):不受影响-漏洞代码不存在
8.openEuler-24.03-LTS-SP1(6.6.0):不受影响-漏洞代码不存在
此处可能存在不合适展示的内容，页面不予展示。您可通过相关编辑功能自查并修改。
如您确认内容无涉及 不当用语 / 纯广告导流 / 暴力 / 低俗色情 / 侵权 / 盗版 / 虚假 / 无价值内容或违法国家有关法律法规的内容，可点击提交进行申诉，我们将尽快为您处理。
| 参考网址 | 关联pr | 状态 | 补丁链接 |
|---|---|---|---|
| https://nvd.nist.gov/vuln/detail/CVE-2022-48842 | None | None | https://git.kernel.org/stable/c/e1014fc5572375658fa421531cedb6e084f477dc https://git.kernel.org/stable/c/a9bbacc53d1f5ed8febbfdf31401d20e005f49ef https://git.kernel.org/stable/c/5cb1ebdbc4342b1c2ce89516e19808d64417bdbc |
| https://ubuntu.com/security/CVE-2022-48842 | None | None | https://discourse.ubuntu.com/c/ubuntu-pro |
| https://www.opencve.io/cve/CVE-2022-48842 | None | None | https://git.kernel.org/stable/c/e1014fc5572375658fa421531cedb6e084f477dc https://git.kernel.org/stable/c/a9bbacc53d1f5ed8febbfdf31401d20e005f49ef https://git.kernel.org/stable/c/5cb1ebdbc4342b1c2ce89516e19808d64417bdbc |
| https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2022-48842 | |||
| https://security-tracker.debian.org/tracker/CVE-2022-48842 |
说明：补丁链接仅供初步排查参考，实际可用性请人工再次确认，补丁下载验证可使用CVE补丁工具。
若补丁不准确，烦请在此issue下评论 '/report-patch 参考网址 补丁链接1,补丁链接2' 反馈正确信息，便于我们不断优化工具，不胜感激。
如 /report-patch https://security-tracker.debian.org/tracker/CVE-2021-3997 https://github.com/systemd/systemd/commit/5b1cf7a9be37e20133c0208005274ce4a5b5c6a1
CVE-2022-48842
影响性分析说明：
In the Linux kernel, the following vulnerability has been resolved:
ice: Fix race condition during interface enslave
Commit 5dbbbd01cbba83 ("ice: Avoid RTNL lock when re-creating
auxiliary device") changes a process of re-creation of aux device
so ice_plug_aux_dev() is called from ice_service_task() context.
This unfortunately opens a race window that can result in dead-lock
when interface has left LAG and immediately enters LAG again.
Reproducer:
#!/bin/sh
ip link add lag0 type bond mode 1 miimon 100
ip link set lag0
for n in {1..10}; do
echo Cycle: $n
ip link set ens7f0 master lag0
sleep 1
ip link set ens7f0 nomaster
done
This results in:
[20976.208697] Workqueue: ice ice_service_task [ice]
[20976.213422] Call Trace:
[20976.215871] __schedule+0x2d1/0x830
[20976.219364] schedule+0x35/0xa0
[20976.222510] schedule_preempt_disabled+0xa/0x10
[20976.227043] __mutex_lock.isra.7+0x310/0x420
[20976.235071] enum_all_gids_of_dev_cb+0x1c/0x100 [ib_core]
[20976.251215] ib_enum_roce_netdev+0xa4/0xe0 [ib_core]
[20976.256192] ib_cache_setup_one+0x33/0xa0 [ib_core]
[20976.261079] ib_register_device+0x40d/0x580 [ib_core]
[20976.266139] irdma_ib_register_device+0x129/0x250 [irdma]
[20976.281409] irdma_probe+0x2c1/0x360 [irdma]
[20976.285691] auxiliary_bus_probe+0x45/0x70
[20976.289790] really_probe+0x1f2/0x480
[20976.298509] driver_probe_device+0x49/0xc0
[20976.302609] bus_for_each_drv+0x79/0xc0
[20976.306448] __device_attach+0xdc/0x160
[20976.310286] bus_probe_device+0x9d/0xb0
[20976.314128] device_add+0x43c/0x890
[20976.321287] __auxiliary_device_add+0x43/0x60
[20976.325644] ice_plug_aux_dev+0xb2/0x100 [ice]
[20976.330109] ice_service_task+0xd0c/0xed0 [ice]
[20976.342591] process_one_work+0x1a7/0x360
[20976.350536] worker_thread+0x30/0x390
[20976.358128] kthread+0x10a/0x120
[20976.365547] ret_from_fork+0x1f/0x40
...
[20976.438030] task:ip state:D stack: 0 pid:213658 ppid:213627 flags:0x00004084
[20976.446469] Call Trace:
[20976.448921] __schedule+0x2d1/0x830
[20976.452414] schedule+0x35/0xa0
[20976.455559] schedule_preempt_disabled+0xa/0x10
[20976.460090] __mutex_lock.isra.7+0x310/0x420
[20976.464364] device_del+0x36/0x3c0
[20976.467772] ice_unplug_aux_dev+0x1a/0x40 [ice]
[20976.472313] ice_lag_event_handler+0x2a2/0x520 [ice]
[20976.477288] notifier_call_chain+0x47/0x70
[20976.481386] __netdev_upper_dev_link+0x18b/0x280
[20976.489845] bond_enslave+0xe05/0x1790 [bonding]
[20976.494475] do_setlink+0x336/0xf50
[20976.502517] __rtnl_newlink+0x529/0x8b0
[20976.543441] rtnl_newlink+0x43/0x60
[20976.546934] rtnetlink_rcv_msg+0x2b1/0x360
[20976.559238] netlink_rcv_skb+0x4c/0x120
[20976.563079] netlink_unicast+0x196/0x230
[20976.567005] netlink_sendmsg+0x204/0x3d0
[20976.570930] sock_sendmsg+0x4c/0x50
[20976.574423] ____sys_sendmsg+0x1eb/0x250
[20976.586807] ___sys_sendmsg+0x7c/0xc0
[20976.606353] __sys_sendmsg+0x57/0xa0
[20976.609930] do_syscall_64+0x5b/0x1a0
[20976.613598] entry_SYSCALL_64_after_hwframe+0x65/0xca
Command 'ip link ... set nomaster' causes that ice_plug_aux_dev()
is called from ice_service_task() context, aux device is created
and associated device->lock is taken.
Command 'ip link ... set master...' calls ice's notifier under
RTNL lock and that notifier calls ice_unplug_aux_dev(). That
function tries to take aux device->lock but this is already taken
by ice_plug_aux_dev() in step 1
Later ice_plug_aux_dev() tries to take RTNL lock but this is already
taken in step 2
Dead-lock
The patch fixes this issue by following changes:
Bit ICE_FLAG_PLUG_AUX_DEV is kept to be set during ice_plug_aux_dev()
call in ice_service_task()
The bit is checked in ice_clear_rdma_cap() and only if it is not set
then ice_unplug_aux_dev() is called. If it is set (in other words
plugging of aux device was requested and ice_plug_aux_dev() is
potentially running) then the function only clears the
---truncated---
openEuler评分:(评分和向量)
4.7
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
受影响版本排查(受影响/不受影响):
1.openEuler-20.03-LTS-SP4:不受影响
2.openEuler-22.03-LTS-SP1:不受影响
3.openEuler-22.03-LTS-SP3:不受影响
4.openEuler-22.03-LTS-SP4:不受影响
5.master(6.1.0):不受影响
6.openEuler-24.03-LTS:不受影响
7.openEuler-24.03-LTS-Next:不受影响
修复是否涉及abi变化(是/否)：
1.openEuler-20.03-LTS-SP4:否
2.openEuler-22.03-LTS-SP1:否
3.openEuler-22.03-LTS-SP3:否
4.master(6.1.0):否
5.openEuler-24.03-LTS:否
6.openEuler-24.03-LTS-Next:否
7.openEuler-22.03-LTS-SP4:否
===========================================================
@ 经过 cve-manager 解析, 已分析的内容如下表所示:
| 状态 | 需分析 | 内容 |
|---|---|---|
| 已分析 | 1.影响性分析说明 | In the Linux kernel, the following vulnerability has been resolved:ice: Fix race condition during interface enslaveCommit 5dbbbd01cbba83 ("ice: Avoid RTNL lock when re-creatingauxiliary device") changes a process of re-creation of aux deviceso ice_plug_aux_dev() is called from ice_service_task() context.This unfortunately opens a race window that can result in dead-lockwhen interface has left LAG and immediately enters LAG again.Reproducer:#!/bin/ship link add lag0 type bond mode 1 miimon 100ip link set lag0for n in {1..10}; do echo Cycle: $n ip link set ens7f0 master lag0 sleep 1 ip link set ens7f0 nomasterdoneThis results in:[20976.208697] Workqueue: ice ice_service_task [ice][20976.213422] Call Trace:[20976.215871] __schedule+0x2d1/0x830[20976.219364] schedule+0x35/0xa0[20976.222510] schedule_preempt_disabled+0xa/0x10[20976.227043] __mutex_lock.isra.7+0x310/0x420[20976.235071] enum_all_gids_of_dev_cb+0x1c/0x100 [ib_core][20976.251215] ib_enum_roce_netdev+0xa4/0xe0 [ib_core][20976.256192] ib_cache_setup_one+0x33/0xa0 [ib_core][20976.261079] ib_register_device+0x40d/0x580 [ib_core][20976.266139] irdma_ib_register_device+0x129/0x250 [irdma][20976.281409] irdma_probe+0x2c1/0x360 [irdma][20976.285691] auxiliary_bus_probe+0x45/0x70[20976.289790] really_probe+0x1f2/0x480[20976.298509] driver_probe_device+0x49/0xc0[20976.302609] bus_for_each_drv+0x79/0xc0[20976.306448] __device_attach+0xdc/0x160[20976.310286] bus_probe_device+0x9d/0xb0[20976.314128] device_add+0x43c/0x890[20976.321287] __auxiliary_device_add+0x43/0x60[20976.325644] ice_plug_aux_dev+0xb2/0x100 [ice][20976.330109] ice_service_task+0xd0c/0xed0 [ice][20976.342591] process_one_work+0x1a7/0x360[20976.350536] worker_thread+0x30/0x390[20976.358128] kthread+0x10a/0x120[20976.365547] ret_from_fork+0x1f/0x40...[20976.438030] task:ip state:D stack: 0 pid:213658 ppid:213627 flags:0x00004084[20976.446469] Call Trace:[20976.448921] __schedule+0x2d1/0x830[20976.452414] schedule+0x35/0xa0[20976.455559] schedule_preempt_disabled+0xa/0x10[20976.460090] __mutex_lock.isra.7+0x310/0x420[20976.464364] device_del+0x36/0x3c0[20976.467772] ice_unplug_aux_dev+0x1a/0x40 [ice][20976.472313] ice_lag_event_handler+0x2a2/0x520 [ice][20976.477288] notifier_call_chain+0x47/0x70[20976.481386] __netdev_upper_dev_link+0x18b/0x280[20976.489845] bond_enslave+0xe05/0x1790 [bonding][20976.494475] do_setlink+0x336/0xf50[20976.502517] __rtnl_newlink+0x529/0x8b0[20976.543441] rtnl_newlink+0x43/0x60[20976.546934] rtnetlink_rcv_msg+0x2b1/0x360[20976.559238] netlink_rcv_skb+0x4c/0x120[20976.563079] netlink_unicast+0x196/0x230[20976.567005] netlink_sendmsg+0x204/0x3d0[20976.570930] sock_sendmsg+0x4c/0x50[20976.574423] ____sys_sendmsg+0x1eb/0x250[20976.586807] ___sys_sendmsg+0x7c/0xc0[20976.606353] __sys_sendmsg+0x57/0xa0[20976.609930] do_syscall_64+0x5b/0x1a0[20976.613598] entry_SYSCALL_64_after_hwframe+0x65/0xcaCommand 'ip link ... set nomaster' causes that ice_plug_aux_dev()is called from ice_service_task() context, aux device is createdand associated device->lock is taken.Command 'ip link ... set master...' calls ice's notifier underRTNL lock and that notifier calls ice_unplug_aux_dev(). Thatfunction tries to take aux device->lock but this is already takenby ice_plug_aux_dev() in step 1Later ice_plug_aux_dev() tries to take RTNL lock but this is alreadytaken in step 2Dead-lockThe patch fixes this issue by following changes:Bit ICE_FLAG_PLUG_AUX_DEV is kept to be set during ice_plug_aux_dev()call in ice_service_task()The bit is checked in ice_clear_rdma_cap() and only if it is not setthen ice_unplug_aux_dev() is called. If it is set (in other wordsplugging of aux device was requested and ice_plug_aux_dev() ispotentially running) then the function only clears the---truncated--- |
| 已分析 | 2.openEulerScore | 4.7 |
| 已分析 | 3.openEulerVector | AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H |
| 已分析 | 4.受影响版本排查 | openEuler-20.03-LTS-SP4:不受影响,openEuler-22.03-LTS-SP1:不受影响,openEuler-22.03-LTS-SP3:不受影响,openEuler-22.03-LTS-SP4:不受影响,master:不受影响,openEuler-24.03-LTS:不受影响,openEuler-24.03-LTS-Next:不受影响 |
| 已分析 | 5.修复是否涉及abi变化 | openEuler-20.03-LTS-SP4:否,openEuler-22.03-LTS-SP1:否,openEuler-22.03-LTS-SP3:否,master:否,openEuler-24.03-LTS:否,openEuler-24.03-LTS-Next:否,openEuler-22.03-LTS-SP4:否 |
请确认分析内容的准确性, 确认无误后, 您可以进行后续步骤, 否则您可以继续分析.
CVE-2022-48842
影响性分析说明：
In the Linux kernel, the following vulnerability has been resolved:
ice: Fix race condition during interface enslave
Commit 5dbbbd01cbba83 ("ice: Avoid RTNL lock when re-creating
auxiliary device") changes a process of re-creation of aux device
so ice_plug_aux_dev() is called from ice_service_task() context.
This unfortunately opens a race window that can result in dead-lock
when interface has left LAG and immediately enters LAG again.
Reproducer:
#!/bin/sh
ip link add lag0 type bond mode 1 miimon 100
ip link set lag0
for n in {1..10}; do
echo Cycle: $n
ip link set ens7f0 master lag0
sleep 1
ip link set ens7f0 nomaster
done
This results in:
[20976.208697] Workqueue: ice ice_service_task [ice]
[20976.213422] Call Trace:
[20976.215871] __schedule+0x2d1/0x830
[20976.219364] schedule+0x35/0xa0
[20976.222510] schedule_preempt_disabled+0xa/0x10
[20976.227043] __mutex_lock.isra.7+0x310/0x420
[20976.235071] enum_all_gids_of_dev_cb+0x1c/0x100 [ib_core]
[20976.251215] ib_enum_roce_netdev+0xa4/0xe0 [ib_core]
[20976.256192] ib_cache_setup_one+0x33/0xa0 [ib_core]
[20976.261079] ib_register_device+0x40d/0x580 [ib_core]
[20976.266139] irdma_ib_register_device+0x129/0x250 [irdma]
[20976.281409] irdma_probe+0x2c1/0x360 [irdma]
[20976.285691] auxiliary_bus_probe+0x45/0x70
[20976.289790] really_probe+0x1f2/0x480
[20976.298509] driver_probe_device+0x49/0xc0
[20976.302609] bus_for_each_drv+0x79/0xc0
[20976.306448] __device_attach+0xdc/0x160
[20976.310286] bus_probe_device+0x9d/0xb0
[20976.314128] device_add+0x43c/0x890
[20976.321287] __auxiliary_device_add+0x43/0x60
[20976.325644] ice_plug_aux_dev+0xb2/0x100 [ice]
[20976.330109] ice_service_task+0xd0c/0xed0 [ice]
[20976.342591] process_one_work+0x1a7/0x360
[20976.350536] worker_thread+0x30/0x390
[20976.358128] kthread+0x10a/0x120
[20976.365547] ret_from_fork+0x1f/0x40
...
[20976.438030] task:ip state:D stack: 0 pid:213658 ppid:213627 flags:0x00004084
[20976.446469] Call Trace:
[20976.448921] __schedule+0x2d1/0x830
[20976.452414] schedule+0x35/0xa0
[20976.455559] schedule_preempt_disabled+0xa/0x10
[20976.460090] __mutex_lock.isra.7+0x310/0x420
[20976.464364] device_del+0x36/0x3c0
[20976.467772] ice_unplug_aux_dev+0x1a/0x40 [ice]
[20976.472313] ice_lag_event_handler+0x2a2/0x520 [ice]
[20976.477288] notifier_call_chain+0x47/0x70
[20976.481386] __netdev_upper_dev_link+0x18b/0x280
[20976.489845] bond_enslave+0xe05/0x1790 [bonding]
[20976.494475] do_setlink+0x336/0xf50
[20976.502517] __rtnl_newlink+0x529/0x8b0
[20976.543441] rtnl_newlink+0x43/0x60
[20976.546934] rtnetlink_rcv_msg+0x2b1/0x360
[20976.559238] netlink_rcv_skb+0x4c/0x120
[20976.563079] netlink_unicast+0x196/0x230
[20976.567005] netlink_sendmsg+0x204/0x3d0
[20976.570930] sock_sendmsg+0x4c/0x50
[20976.574423] ____sys_sendmsg+0x1eb/0x250
[20976.586807] ___sys_sendmsg+0x7c/0xc0
[20976.606353] __sys_sendmsg+0x57/0xa0
[20976.609930] do_syscall_64+0x5b/0x1a0
[20976.613598] entry_SYSCALL_64_after_hwframe+0x65/0xca
The patch fixes this issue by following changes:
openEuler评分:(评分和向量)
4.7
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
受影响版本排查(受影响/不受影响):
1.openEuler-20.03-LTS-SP4:不受影响
2.openEuler-22.03-LTS-SP1:不受影响
3.openEuler-22.03-LTS-SP3:不受影响
4.openEuler-22.03-LTS-SP4:不受影响
5.master(23.08.5):不受影响
6.openEuler-24.03-LTS:不受影响
7.openEuler-24.03-LTS-Next:不受影响
8.openEuler-24.03-LTS-SP1:不受影响
修复是否涉及abi变化(是/否)：
1.openEuler-20.03-LTS-SP4:否
2.openEuler-22.03-LTS-SP1:否
3.openEuler-22.03-LTS-SP3:否
4.master(23.08.5):否
5.openEuler-24.03-LTS:否
6.openEuler-24.03-LTS-Next:否
7.openEuler-22.03-LTS-SP4:否
8.openEuler-24.03-LTS-SP1:否
===========================================================
CVE-2022-48842
影响性分析说明：
In the Linux kernel, the following vulnerability has been resolved:
ice: Fix race condition during interface enslave
Commit 5dbbbd01cbba83 ("ice: Avoid RTNL lock when re-creating
auxiliary device") changes a process of re-creation of aux device
so ice_plug_aux_dev() is called from ice_service_task() context.
This unfortunately opens a race window that can result in dead-lock
when interface has left LAG and immediately enters LAG again.
Reproducer:
#!/bin/sh
ip link add lag0 type bond mode 1 miimon 100
ip link set lag0
for n in {1..10}; do
echo Cycle: $n
ip link set ens7f0 master lag0
sleep 1
ip link set ens7f0 nomaster
done
This results in:
[20976.208697] Workqueue: ice ice_service_task [ice]
[20976.213422] Call Trace:
[20976.215871] __schedule+0x2d1/0x830
[20976.219364] schedule+0x35/0xa0
[20976.222510] schedule_preempt_disabled+0xa/0x10
[20976.227043] __mutex_lock.isra.7+0x310/0x420
[20976.235071] enum_all_gids_of_dev_cb+0x1c/0x100 [ib_core]
[20976.251215] ib_enum_roce_netdev+0xa4/0xe0 [ib_core]
[20976.256192] ib_cache_setup_one+0x33/0xa0 [ib_core]
[20976.261079] ib_register_device+0x40d/0x580 [ib_core]
[20976.266139] irdma_ib_register_device+0x129/0x250 [irdma]
[20976.281409] irdma_probe+0x2c1/0x360 [irdma]
[20976.285691] auxiliary_bus_probe+0x45/0x70
[20976.289790] really_probe+0x1f2/0x480
[20976.298509] driver_probe_device+0x49/0xc0
[20976.302609] bus_for_each_drv+0x79/0xc0
[20976.306448] __device_attach+0xdc/0x160
[20976.310286] bus_probe_device+0x9d/0xb0
[20976.314128] device_add+0x43c/0x890
[20976.321287] __auxiliary_device_add+0x43/0x60
[20976.325644] ice_plug_aux_dev+0xb2/0x100 [ice]
[20976.330109] ice_service_task+0xd0c/0xed0 [ice]
[20976.342591] process_one_work+0x1a7/0x360
[20976.350536] worker_thread+0x30/0x390
[20976.358128] kthread+0x10a/0x120
[20976.365547] ret_from_fork+0x1f/0x40
...
[20976.438030] task:ip state:D stack: 0 pid:213658 ppid:213627 flags:0x00004084
[20976.446469] Call Trace:
[20976.448921] __schedule+0x2d1/0x830
[20976.452414] schedule+0x35/0xa0
[20976.455559] schedule_preempt_disabled+0xa/0x10
[20976.460090] __mutex_lock.isra.7+0x310/0x420
[20976.464364] device_del+0x36/0x3c0
[20976.467772] ice_unplug_aux_dev+0x1a/0x40 [ice]
[20976.472313] ice_lag_event_handler+0x2a2/0x520 [ice]
[20976.477288] notifier_call_chain+0x47/0x70
[20976.481386] __netdev_upper_dev_link+0x18b/0x280
[20976.489845] bond_enslave+0xe05/0x1790 [bonding]
[20976.494475] do_setlink+0x336/0xf50
[20976.502517] __rtnl_newlink+0x529/0x8b0
[20976.543441] rtnl_newlink+0x43/0x60
[20976.546934] rtnetlink_rcv_msg+0x2b1/0x360
[20976.559238] netlink_rcv_skb+0x4c/0x120
[20976.563079] netlink_unicast+0x196/0x230
[20976.567005] netlink_sendmsg+0x204/0x3d0
[20976.570930] sock_sendmsg+0x4c/0x50
[20976.574423] ____sys_sendmsg+0x1eb/0x250
[20976.586807] ___sys_sendmsg+0x7c/0xc0
[20976.606353] __sys_sendmsg+0x57/0xa0
[20976.609930] do_syscall_64+0x5b/0x1a0
[20976.613598] entry_SYSCALL_64_after_hwframe+0x65/0xca
The patch fixes this issue by following changes:
openEuler评分:(评分和向量)
4.7
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
受影响版本排查(受影响/不受影响):
1.openEuler-20.03-LTS-SP4:不受影响
2.openEuler-22.03-LTS-SP1:不受影响
3.openEuler-22.03-LTS-SP3:不受影响
4.openEuler-22.03-LTS-SP4:不受影响
5.master(6.6.0):不受影响
6.openEuler-24.03-LTS:不受影响
7.openEuler-24.03-LTS-Next:不受影响
8.openEuler-24.03-LTS-SP1:不受影响
原因说明:
1.openEuler-20.03-LTS-SP4:不受影响-漏洞代码不存在
2.openEuler-22.03-LTS-SP1:不受影响-漏洞代码不存在
3.openEuler-22.03-LTS-SP3:不受影响-漏洞代码不存在
4.openEuler-22.03-LTS-SP4:不受影响-漏洞代码不存在
5.master(6.6.0):不受影响-漏洞代码不存在
6.openEuler-24.03-LTS:不受影响-漏洞代码不存在
7.openEuler-24.03-LTS-Next:不受影响-漏洞代码不存在
8.openEuler-24.03-LTS-SP1:不受影响-漏洞代码不存在
修复是否涉及abi变化(是/否)：
1.openEuler-20.03-LTS-SP4:否
2.openEuler-22.03-LTS-SP1:否
3.openEuler-22.03-LTS-SP3:否
4.master(23.08.5):否
5.openEuler-24.03-LTS:否
6.openEuler-24.03-LTS-Next:否
7.openEuler-22.03-LTS-SP4:否
8.openEuler-24.03-LTS-SP1:否
===========================================================
登录 后才可以发表评论
FileDragTip