CVE-2024-42083

一、漏洞信息
 漏洞编号：[CVE-2024-42083](https://nvd.nist.gov/vuln/detail/CVE-2024-42083)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.0,6.1.14,6.1.19,6.1.5,6.1.6,6.1.8,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：5.5 Medium
  Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:ionic: fix kernel panic due to multi-buffer handlingCurrently, the ionic_run_xdp() doesn t handle multi-buffer packetsproperly for XDP_TX and XDP_REDIRECT.When a jumbo frame is received, the ionic_run_xdp() first makes xdpframe with all necessary pages in the rx descriptor.And if the action is either XDP_TX or XDP_REDIRECT, it should unmapdma-mapping and reset page pointer to NULL for all pages, not only thefirst page.But it doesn t for SG pages. So, SG pages unexpectedly will be reused.It eventually causes kernel panic.Oops: general protection fault, probably for non-canonical address 0x504f4e4dbebc64ff: 0000 [#1] PREEMPT SMP NOPTICPU: 3 PID: 0 Comm: swapper/3 Not tainted 6.10.0-rc3+ #25RIP: 0010:xdp_return_frame+0x42/0x90Code: 01 75 12 5b 4c 89 e6 5d 31 c9 41 5c 31 d2 41 5d e9 73 fd ff ff 44 8b 6b 20 0f b7 43 0a 49 81 ed 68 01 00 00 49 29 c5 49 01 fd <41> 80 7d0RSP: 0018:ffff99d00122ce08 EFLAGS: 00010202RAX: 0000000000005453 RBX: ffff8d325f904000 RCX: 0000000000000001RDX: 00000000670e1000 RSI: 000000011f90d000 RDI: 504f4e4d4c4b4a49RBP: ffff99d003907740 R08: 0000000000000000 R09: 0000000000000000R10: 000000011f90d000 R11: 0000000000000000 R12: ffff8d325f904010R13: 504f4e4dbebc64fd R14: ffff8d3242b070c8 R15: ffff99d0039077c0FS:  0000000000000000(0000) GS:ffff8d399f780000(0000) knlGS:0000000000000000CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033CR2: 00007f41f6c85e38 CR3: 000000037ac30000 CR4: 00000000007506f0PKRU: 55555554Call Trace: <IRQ> ? die_addr+0x33/0x90 ? exc_general_protection+0x251/0x2f0 ? asm_exc_general_protection+0x22/0x30 ? xdp_return_frame+0x42/0x90 ionic_tx_clean+0x211/0x280 [ionic 15881354510e6a9c655c59c54812b319ed2cd015] ionic_tx_cq_service+0xd3/0x210 [ionic 15881354510e6a9c655c59c54812b319ed2cd015] ionic_txrx_napi+0x41/0x1b0 [ionic 15881354510e6a9c655c59c54812b319ed2cd015] __napi_poll.constprop.0+0x29/0x1b0 net_rx_action+0x2c4/0x350 handle_softirqs+0xf4/0x320 irq_exit_rcu+0x78/0xa0 common_interrupt+0x77/0x90
 漏洞公开时间：2024-07-30 00:15:07
 漏洞创建时间：2024-07-30 01:13:03
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2024-42083
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/8ae401525ae84228a8986bb369224a6224e4d22f |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/e3f02f32a05009a688a87f5799e049ed6b55bab5 |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-42083 | https://bugzilla.suse.com/show_bug.cgi?id=1228514 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2024/CVE-2024-42083.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1228514 |
| suse_bugzilla | https://git.kernel.org/stable/c/8ae401525ae84228a8986bb369224a6224e4d22f | https://bugzilla.suse.com/show_bug.cgi?id=1228514 |
| suse_bugzilla | https://git.kernel.org/stable/c/e3f02f32a05009a688a87f5799e049ed6b55bab5 | https://bugzilla.suse.com/show_bug.cgi?id=1228514 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2024-42083 | https://bugzilla.suse.com/show_bug.cgi?id=1228514 |
| redhat_bugzilla | https://lore.kernel.org/linux-cve-announce/2024072947-CVE-2024-42083-9d35@gregkh/T | https://bugzilla.redhat.com/show_bug.cgi?id=2300521 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2024-42083 |
| amazon_linux_explore | https://access.redhat.com/security/cve/CVE-2024-42083 | https://explore.alas.aws.amazon.com/CVE-2024-42083.html |
| amazon_linux_explore | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-42083 | https://explore.alas.aws.amazon.com/CVE-2024-42083.html |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://git.kernel.org/stable/c/8ae401525ae84228a8986bb369224a6224e4d22f |  | nvd |
|  |  | https://git.kernel.org/stable/c/e3f02f32a05009a688a87f5799e049ed6b55bab5 |  | nvd |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:ionic: fix kernel panic due to multi-buffer handlingCurrently, the ionic_run_xdp() doesn t handle multi-buffer packetsproperly for XDP_TX and XDP_REDIRECT.When a jumbo frame is received, the ionic_run_xdp() first makes xdpframe with all necessary pages in the rx descriptor.And if the action is either XDP_TX or XDP_REDIRECT, it should unmapdma-mapping and reset page pointer to NULL for all pages, not only thefirst page.But it doesn t for SG pages. So, SG pages unexpectedly will be reused.It eventually causes kernel panic.Oops: general protection fault, probably for non-canonical address 0x504f4e4dbebc64ff: 0000 [#1] PREEMPT SMP NOPTICPU: 3 PID: 0 Comm: swapper/3 Not tainted 6.10.0-rc3+ #25RIP: 0010:xdp_return_frame+0x42/0x90Code: 01 75 12 5b 4c 89 e6 5d 31 c9 41 5c 31 d2 41 5d e9 73 fd ff ff 44 8b 6b 20 0f b7 43 0a 49 81 ed 68 01 00 00 49 29 c5 49 01 fd <41> 80 7d0RSP: 0018:ffff99d00122ce08 EFLAGS: 00010202RAX: 0000000000005453 RBX: ffff8d325f904000 RCX: 0000000000000001RDX: 00000000670e1000 RSI: 000000011f90d000 RDI: 504f4e4d4c4b4a49RBP: ffff99d003907740 R08: 0000000000000000 R09: 0000000000000000R10: 000000011f90d000 R11: 0000000000000000 R12: ffff8d325f904010R13: 504f4e4dbebc64fd R14: ffff8d3242b070c8 R15: ffff99d0039077c0FS:  0000000000000000(0000) GS:ffff8d399f780000(0000) knlGS:0000000000000000CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033CR2: 00007f41f6c85e38 CR3: 000000037ac30000 CR4: 00000000007506f0PKRU: 55555554Call Trace: <IRQ> ? die_addr+0x33/0x90 ? exc_general_protection+0x251/0x2f0 ? asm_exc_general_protection+0x22/0x30 ? xdp_return_frame+0x42/0x90 ionic_tx_clean+0x211/0x280 [ionic 15881354510e6a9c655c59c54812b319ed2cd015] ionic_tx_cq_service+0xd3/0x210 [ionic 15881354510e6a9c655c59c54812b319ed2cd015] ionic_txrx_napi+0x41/0x1b0 [ionic 15881354510e6a9c655c59c54812b319ed2cd015] __napi_poll.constprop.0+0x29/0x1b0 net_rx_action+0x2c4/0x350 handle_softirqs+0xf4/0x320 irq_exit_rcu+0x78/0xa0 common_interrupt+0x77/0x90
 openEuler评分：
  5.5
 Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP4(4.19.90):不受影响
2.openEuler-22.03-LTS-SP1(5.10.0):不受影响
3.openEuler-22.03-LTS-SP3(5.10.0):不受影响
4.openEuler-22.03-LTS-SP4(5.10.0):不受影响
5.master(6.1.0):不受影响
6.openEuler-24.03-LTS(6.6.0):不受影响
7.openEuler-24.03-LTS-Next(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP4(4.19.90):否
2.openEuler-22.03-LTS-SP1(5.10.0):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.master(6.1.0):否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-22.03-LTS-SP4(5.10.0):否

src-openEuler/kernel
Closed

Content Risk Flag

Comments (8)

src-openEuler/kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2024-42083

Comments (8)

Search

src-openEuler/kernel
Closed