CVE-2024-41009

一、漏洞信息
 漏洞编号：[CVE-2024-41009](https://nvd.nist.gov/vuln/detail/CVE-2024-41009)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.0,6.1.14,6.1.19,6.1.5,6.1.6,6.1.8,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：5.5 Medium
  Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:bpf: Fix overrunning reservations in ringbufThe BPF ring buffer internally is implemented as a power-of-2 sized circularbuffer, with two logical and ever-increasing counters: consumer_pos is theconsumer counter to show which logical position the consumer consumed thedata, and producer_pos which is the producer counter denoting the amount ofdata reserved by all producers.Each time a record is reserved, the producer that  owns  the record willsuccessfully advance producer counter. In user space each time a record isread, the consumer of the data advanced the consumer counter once it finishedprocessing. Both counters are stored in separate pages so that from userspace, the producer counter is read-only and the consumer counter is read-write.One aspect that simplifies and thus speeds up the implementation of bothproducers and consumers is how the data area is mapped twice contiguouslyback-to-back in the virtual memory, allowing to not take any special measuresfor samples that have to wrap around at the end of the circular buffer dataarea, because the next page after the last data page would be first data pageagain, and thus the sample will still appear completely contiguous in virtualmemory.Each record has a struct bpf_ringbuf_hdr { u32 len; u32 pg_off; } header forbook-keeping the length and offset, and is inaccessible to the BPF program.Helpers like bpf_ringbuf_reserve() return `(void *)hdr + BPF_RINGBUF_HDR_SZ`for the BPF program to use. Bing-Jhong and Muhammad reported that it is howeverpossible to make a second allocated memory chunk overlapping with the firstchunk and as a result, the BPF program is now able to edit first chunk sheader.For example, consider the creation of a BPF_MAP_TYPE_RINGBUF map with sizeof 0x4000. Next, the consumer_pos is modified to 0x3000 /before/ a call tobpf_ringbuf_reserve() is made. This will allocate a chunk A, which is in[0x0,0x3008], and the BPF program is able to edit [0x8,0x3008]. Now, letsallocate a chunk B with size 0x3000. This will succeed because consumer_poswas edited ahead of time to pass the `new_prod_pos - cons_pos > rb->mask`check. Chunk B will be in range [0x3008,0x6010], and the BPF program is ableto edit [0x3010,0x6010]. Due to the ring buffer memory layout mentionedearlier, the ranges [0x0,0x4000] and [0x4000,0x8000] point to the same datapages. This means that chunk B at [0x4000,0x4008] is chunk A s header.bpf_ringbuf_submit() / bpf_ringbuf_discard() use the header s pg_off to thenlocate the bpf_ringbuf itself via bpf_ringbuf_restore_from_rec(). Once chunkB modified chunk A s header, then bpf_ringbuf_commit() refers to the wrongpage and could cause a crash.Fix it by calculating the oldest pending_pos and check whether the rangefrom the oldest outstanding record to the newest would span beyond the ringbuffer size. If that is the case, then reject the request. We ve tested withthe ring buffer benchmark in BPF selftests (./benchs/run_bench_ringbufs.sh)before/after the fix and while it seems a bit slower on some benchmarks, itis still not significantly enough to matter.
 漏洞公开时间：2024-07-17 15:15:01
 漏洞创建时间：2024-07-18 06:52:49
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2024-41009
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/47416c852f2a04d348ea66ee451cbdcf8119f225 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/511804ab701c0503b72eac08217eabfd366ba069 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/cfa1a2329a691ffd991fcf7248a57d752e712881 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/d1b9df0435bc61e0b44f578846516df8ef476686 |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-41009 | https://bugzilla.suse.com/show_bug.cgi?id=1228020 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2024-41009 | https://bugzilla.suse.com/show_bug.cgi?id=1228020 |
| suse_bugzilla | https://git.kernel.org/stable/c/47416c852f2a04d348ea66ee451cbdcf8119f225 | https://bugzilla.suse.com/show_bug.cgi?id=1228020 |
| suse_bugzilla | https://git.kernel.org/stable/c/511804ab701c0503b72eac08217eabfd366ba069 | https://bugzilla.suse.com/show_bug.cgi?id=1228020 |
| suse_bugzilla | https://git.kernel.org/stable/c/cfa1a2329a691ffd991fcf7248a57d752e712881 | https://bugzilla.suse.com/show_bug.cgi?id=1228020 |
| suse_bugzilla | https://git.kernel.org/stable/c/d1b9df0435bc61e0b44f578846516df8ef476686 | https://bugzilla.suse.com/show_bug.cgi?id=1228020 |
| ubuntu | https://www.cve.org/CVERecord?id=CVE-2024-41009 | https://ubuntu.com/security/CVE-2024-41009 |
| ubuntu | https://git.kernel.org/linus/cfa1a2329a691ffd991fcf7248a57d752e712881 (6.10-rc6) | https://ubuntu.com/security/CVE-2024-41009 |
| ubuntu | https://git.kernel.org/stable/c/d1b9df0435bc61e0b44f578846516df8ef476686 | https://ubuntu.com/security/CVE-2024-41009 |
| ubuntu | https://git.kernel.org/stable/c/511804ab701c0503b72eac08217eabfd366ba069 | https://ubuntu.com/security/CVE-2024-41009 |
| ubuntu | https://git.kernel.org/stable/c/47416c852f2a04d348ea66ee451cbdcf8119f225 | https://ubuntu.com/security/CVE-2024-41009 |
| ubuntu | https://git.kernel.org/stable/c/cfa1a2329a691ffd991fcf7248a57d752e712881 | https://ubuntu.com/security/CVE-2024-41009 |
| ubuntu | https://nvd.nist.gov/vuln/detail/CVE-2024-41009 | https://ubuntu.com/security/CVE-2024-41009 |
| ubuntu | https://launchpad.net/bugs/cve/CVE-2024-41009 | https://ubuntu.com/security/CVE-2024-41009 |
| ubuntu | https://security-tracker.debian.org/tracker/CVE-2024-41009 | https://ubuntu.com/security/CVE-2024-41009 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2024-41009 |
| cve_search |  | https://git.kernel.org/stable/c/d1b9df0435bc61e0b44f578846516df8ef476686 |
| cve_search |  | https://git.kernel.org/stable/c/511804ab701c0503b72eac08217eabfd366ba069 |
| cve_search |  | https://git.kernel.org/stable/c/47416c852f2a04d348ea66ee451cbdcf8119f225 |
| cve_search |  | https://git.kernel.org/stable/c/cfa1a2329a691ffd991fcf7248a57d752e712881 |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/47416c852f2a04d348ea66ee451cbdcf8119f225 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/511804ab701c0503b72eac08217eabfd366ba069 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/cfa1a2329a691ffd991fcf7248a57d752e712881 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/d1b9df0435bc61e0b44f578846516df8ef476686 |  |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://git.kernel.org/stable/c/47416c852f2a04d348ea66ee451cbdcf8119f225 |  | nvd |
|  |  | https://git.kernel.org/stable/c/511804ab701c0503b72eac08217eabfd366ba069 |  | nvd |
|  |  | https://git.kernel.org/stable/c/cfa1a2329a691ffd991fcf7248a57d752e712881 |  | nvd |
|  |  | https://git.kernel.org/stable/c/d1b9df0435bc61e0b44f578846516df8ef476686 |  | nvd |
| linux |  | https://git.kernel.org/linus/cfa1a2329a691ffd991fcf7248a57d752e712881 | https://git.kernel.org/linus/457f44363a8894135c85b7a9afd2bd8196db24ab | ubuntu |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
        In the Linux kernel, the following vulnerability has been resolved:bpf: Fix overrunning reservations in ringbufThe BPF ring buffer internally is implemented as a power-of-2 sized circularbuffer, with two logical and ever-increasing counters: consumer_pos is theconsumer counter to show which logical position the consumer consumed thedata, and producer_pos which is the producer counter denoting the amount ofdata reserved by all producers.Each time a record is reserved, the producer that &#34;owns&#34; the record willsuccessfully advance producer counter. In user space each time a record isread, the consumer of the data advanced the consumer counter once it finishedprocessing. Both counters are stored in separate pages so that from userspace, the producer counter is read-only and the consumer counter is read-write.One aspect that simplifies and thus speeds up the implementation of bothproducers and consumers is how the data area is mapped twice contiguouslyback-to-back in the virtual memory, allowing to not take any special measuresfor samples that have to wrap around at the end of the circular buffer dataarea, because the next page after the last data page would be first data pageagain, and thus the sample will still appear completely contiguous in virtualmemory.Each record has a struct bpf_ringbuf_hdr { u32 len; u32 pg_off; } header forbook-keeping the length and offset, and is inaccessible to the BPF program.Helpers like bpf_ringbuf_reserve() return `(void *)hdr + BPF_RINGBUF_HDR_SZ`for the BPF program to use. Bing-Jhong and Muhammad reported that it is howeverpossible to make a second allocated memory chunk overlapping with the firstchunk and as a result, the BPF program is now able to edit first chunk&#39;sheader.For example, consider the creation of a BPF_MAP_TYPE_RINGBUF map with sizeof 0x4000. Next, the consumer_pos is modified to 0x3000 /before/ a call tobpf_ringbuf_reserve() is made. This will allocate a chunk A, which is in[0x0,0x3008], and the BPF program is able to edit [0x8,0x3008]. Now, letsallocate a chunk B with size 0x3000. This will succeed because consumer_poswas edited ahead of time to pass the `new_prod_pos - cons_pos &gt; rb-&gt;mask`check. Chunk B will be in range [0x3008,0x6010], and the BPF program is ableto edit [0x3010,0x6010]. Due to the ring buffer memory layout mentionedearlier, the ranges [0x0,0x4000] and [0x4000,0x8000] point to the same datapages. This means that chunk B at [0x4000,0x4008] is chunk A&#39;s header.bpf_ringbuf_submit() / bpf_ringbuf_discard() use the header&#39;s pg_off to thenlocate the bpf_ringbuf itself via bpf_ringbuf_restore_from_rec(). Once chunkB modified chunk A&#39;s header, then bpf_ringbuf_commit() refers to the wrongpage and could cause a crash.Fix it by calculating the oldest pending_pos and check whether the rangefrom the oldest outstanding record to the newest would span beyond the ringbuffer size. If that is the case, then reject the request. We&#39;ve tested withthe ring buffer benchmark in BPF selftests (./benchs/run_bench_ringbufs.sh)before/after the fix and while it seems a bit slower on some benchmarks, itis still not significantly enough to matter.The Linux kernel CVE team has assigned CVE-2024-41009 to this issue.   
 openEuler评分：
  5.5
 Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-22.03-LTS-SP1(5.10.0):受影响
2.openEuler-22.03-LTS-SP3(5.10.0):受影响
3.openEuler-24.03-LTS(6.6.0):受影响
4.openEuler-20.03-LTS-SP4(4.19.90):不受影响
5.openEuler-22.03-LTS-SP4(5.10.0):不受影响
6.master(6.1.0):不受影响
7.openEuler-24.03-LTS-Next(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP4(4.19.90):否
2.openEuler-22.03-LTS-SP1(5.10.0):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.master(6.1.0):否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-22.03-LTS-SP4(5.10.0):否

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2024-1897

src-openEuler / kernel
Closed

Content Risk Flag

Comments (19)

src-openEuler / kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2024-41009

Comments (19)

Search

src-openEuler / kernel
Closed