CVE-2024-42243

一、漏洞信息
 漏洞编号：[CVE-2024-42243](https://nvd.nist.gov/vuln/detail/CVE-2024-42243)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.0,6.1.14,6.1.19,6.1.5,6.1.6,6.1.8,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：5.5 Medium
  Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:mm/filemap: make MAX_PAGECACHE_ORDER acceptable to xarrayPatch series  mm/filemap: Limit page cache size to that supported byxarray , v2.Currently, xarray can t support arbitrary page cache size.  More detailscan be found from the WARN_ON() statement in xas_split_alloc().  In ourtest whose code is attached below, we hit the WARN_ON() on ARM64 systemwhere the base page size is 64KB and huge page size is 512MB.  The issuewas reported long time ago and some discussions on it can be found here[1].[1] https://www.spinics.net/lists/linux-xfs/msg75404.htmlIn order to fix the issue, we need to adjust MAX_PAGECACHE_ORDER to onesupported by xarray and avoid PMD-sized page cache if needed.  The codechanges are suggested by David Hildenbrand.PATCH[1] adjusts MAX_PAGECACHE_ORDER to that supported by xarrayPATCH[2-3] avoids PMD-sized page cache in the synchronous readahead pathPATCH[4] avoids PMD-sized page cache for shmem files if neededTest program============# cat test.c#define _GNU_SOURCE#include <stdio.h>#include <stdlib.h>#include <unistd.h>#include <string.h>#include <fcntl.h>#include <errno.h>#include <sys/syscall.h>#include <sys/mman.h>#define TEST_XFS_FILENAME	 /tmp/data #define TEST_SHMEM_FILENAME	 /dev/shm/data #define TEST_MEM_SIZE		0x20000000int main(int argc, char **argv){	const char *filename;	int fd = 0;	void *buf = (void *)-1, *p;	int pgsize = getpagesize();	int ret;	if (pgsize != 0x10000) {		fprintf(stderr,  64KB base page size is required n );		return -EPERM;	}	system( echo force > /sys/kernel/mm/transparent_hugepage/shmem_enabled );	system( rm -fr /tmp/data );	system( rm -fr /dev/shm/data );	system( echo 1 > /proc/sys/vm/drop_caches );	/* Open xfs or shmem file */	filename = TEST_XFS_FILENAME;	if (argc > 1 && !strcmp(argv[1],  shmem ))		filename = TEST_SHMEM_FILENAME;	fd = open(filename, O_CREAT | O_RDWR | O_TRUNC);	if (fd < 0) {		fprintf(stderr,  Unable to open <%s> n , filename);		return -EIO;	}	/* Extend file size */	ret = ftruncate(fd, TEST_MEM_SIZE);	if (ret) {		fprintf(stderr,  Error %d to ftruncate() n , ret);		goto cleanup;	}	/* Create VMA */	buf = mmap(NULL, TEST_MEM_SIZE,		   PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0);	if (buf == (void *)-1) {		fprintf(stderr,  Unable to mmap <%s> n , filename);		goto cleanup;	}	fprintf(stdout,  mapped buffer at 0x%p n , buf);	ret = madvise(buf, TEST_MEM_SIZE, MADV_HUGEPAGE);        if (ret) {		fprintf(stderr,  Unable to madvise(MADV_HUGEPAGE) n );		goto cleanup;	}	/* Populate VMA */	ret = madvise(buf, TEST_MEM_SIZE, MADV_POPULATE_WRITE);	if (ret) {		fprintf(stderr,  Error %d to madvise(MADV_POPULATE_WRITE) n , ret);		goto cleanup;	}	/* Punch the file to enforce xarray split */	ret = fallocate(fd, FALLOC_FL_KEEP_SIZE | FALLOC_FL_PUNCH_HOLE,        		TEST_MEM_SIZE - pgsize, pgsize);	if (ret)		fprintf(stderr,  Error %d to fallocate() n , ret);cleanup:	if (buf != (void *)-1)		munmap(buf, TEST_MEM_SIZE);	if (fd > 0)		close(fd);	return 0;}# gcc test.c -o test# cat /proc/1/smaps | grep KernelPageSize | head -n 1KernelPageSize:       64 kB# ./test shmem   :------------[ cut here ]------------WARNING: CPU: 17 PID: 5253 at lib/xarray.c:1025 xas_split_alloc+0xf8/0x128Modules linked in: nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib   nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct     nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4     ip_set nf_tables rfkill nfnetlink vfat fat virtio_balloon           drm fuse xfs libcrc32c crct10dif_ce ghash_ce sha2_ce sha256_arm64   virtio_net sha1_ce net_failover failover virtio_console virtio_blk  dimlib virtio_mmioCPU: 17 PID: 5253 Comm: test Kdump: loaded Tainted: G W 6.10.0-rc5-gavin+ #12Hardware name: QEMU KVM Virtual Machine, BIOS edk2-20240524-1.el9 05/24/2024pstate: 83400005 (Nzcv daif +PAN -UAO +TC---truncated---
 漏洞公开时间：2024-08-08 00:15:47
 漏洞创建时间：2024-08-08 08:56:06
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2024-42243
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/099d90642a711caae377f53309abfe27e8724a8b |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/333c5539a31f48828456aa9997ec2808f06a699a |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/a0c42ddd0969fdc760a85e20e267776028a7ca4e |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-42243 | https://bugzilla.suse.com/show_bug.cgi?id=1229001 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2024/CVE-2024-42243.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1229001 |
| suse_bugzilla | https://git.kernel.org/stable/c/a0c42ddd0969fdc760a85e20e267776028a7ca4e | https://bugzilla.suse.com/show_bug.cgi?id=1229001 |
| suse_bugzilla | https://git.kernel.org/stable/c/333c5539a31f48828456aa9997ec2808f06a699a | https://bugzilla.suse.com/show_bug.cgi?id=1229001 |
| suse_bugzilla | https://git.kernel.org/stable/c/099d90642a711caae377f53309abfe27e8724a8b | https://bugzilla.suse.com/show_bug.cgi?id=1229001 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2024-42243 | https://bugzilla.suse.com/show_bug.cgi?id=1229001 |
| ubuntu | https://www.cve.org/CVERecord?id=CVE-2024-42243 | https://ubuntu.com/security/CVE-2024-42243 |
| ubuntu | https://git.kernel.org/linus/099d90642a711caae377f53309abfe27e8724a8b (6.10) | https://ubuntu.com/security/CVE-2024-42243 |
| ubuntu | https://git.kernel.org/stable/c/a0c42ddd0969fdc760a85e20e267776028a7ca4e | https://ubuntu.com/security/CVE-2024-42243 |
| ubuntu | https://git.kernel.org/stable/c/333c5539a31f48828456aa9997ec2808f06a699a | https://ubuntu.com/security/CVE-2024-42243 |
| ubuntu | https://git.kernel.org/stable/c/099d90642a711caae377f53309abfe27e8724a8b | https://ubuntu.com/security/CVE-2024-42243 |
| ubuntu | https://nvd.nist.gov/vuln/detail/CVE-2024-42243 | https://ubuntu.com/security/CVE-2024-42243 |
| ubuntu | https://launchpad.net/bugs/cve/CVE-2024-42243 | https://ubuntu.com/security/CVE-2024-42243 |
| ubuntu | https://security-tracker.debian.org/tracker/CVE-2024-42243 | https://ubuntu.com/security/CVE-2024-42243 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2024-42243 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://git.kernel.org/stable/c/099d90642a711caae377f53309abfe27e8724a8b |  | nvd |
|  |  | https://git.kernel.org/stable/c/333c5539a31f48828456aa9997ec2808f06a699a |  | nvd |
|  |  | https://git.kernel.org/stable/c/a0c42ddd0969fdc760a85e20e267776028a7ca4e |  | nvd |
| linux |  | https://git.kernel.org/linus/099d90642a711caae377f53309abfe27e8724a8b | https://git.kernel.org/linus/1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 | ubuntu |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
    In the Linux kernel, the following vulnerability has been resolved:mm/filemap: make MAX_PAGECACHE_ORDER acceptable to xarrayPatch series &#34;mm/filemap: Limit page cache size to that supported byxarray&#34;, v2.Currently, xarray can&#39;t support arbitrary page cache size.  More detailscan be found from the WARN_ON() statement in xas_split_alloc().  In ourtest whose code is attached below, we hit the WARN_ON() on ARM64 systemwhere the base page size is 64KB and huge page size is 512MB.  The issuewas reported long time ago and some discussions on it can be found here[1].[1] <ahref= https://www.spinics.net/lists/linux-xfs/msg75404.html >https://www.spinics.net/lists/linux-xfs/msg75404.html</a>In order to fix the issue, we need to adjust MAX_PAGECACHE_ORDER to onesupported by xarray and avoid PMD-sized page cache if needed.  The codechanges are suggested by David Hildenbrand.PATCH[1] adjusts MAX_PAGECACHE_ORDER to that supported by xarrayPATCH[2-3] avoids PMD-sized page cache in the synchronous readahead pathPATCH[4] avoids PMD-sized page cache for shmem files if neededTest program============# cat test.c#define _GNU_SOURCE#include &lt;stdio.h&gt;#include &lt;stdlib.h&gt;#include &lt;unistd.h&gt;#include &lt;string.h&gt;#include &lt;fcntl.h&gt;#include &lt;errno.h&gt;#include &lt;sys/syscall.h&gt;#include &lt;sys/mman.h&gt;#define TEST_XFS_FILENAME&#34;/tmp/data&#34;#define TEST_SHMEM_FILENAME&#34;/dev/shm/data&#34;#define TEST_MEM_SIZE0x20000000int main(int argc, char **argv){const char *filename;int fd = 0;void *buf = (void *)-1, *p;int pgsize = getpagesize();int ret;if (pgsize != 0x10000) {fprintf(stderr, &#34;64KB base page size is required n&#34;);return -EPERM;}system(&#34;echo force &gt; /sys/kernel/mm/transparent_hugepage/shmem_enabled&#34;);system(&#34;rm -fr /tmp/data&#34;);system(&#34;rm -fr /dev/shm/data&#34;);system(&#34;echo 1 &gt; /proc/sys/vm/drop_caches&#34;);/* Open xfs or shmem file */filename = TEST_XFS_FILENAME;if (argc &gt; 1 &#38;&#38; !strcmp(argv[1], &#34;shmem&#34;))filename = TEST_SHMEM_FILENAME;fd = open(filename, O_CREAT | O_RDWR | O_TRUNC);if (fd &lt; 0) {fprintf(stderr, &#34;Unable to open &lt;%s&gt; n&#34;, filename);return -EIO;}/* Extend file size */ret = ftruncate(fd, TEST_MEM_SIZE);if (ret) {fprintf(stderr, &#34;Error %d to ftruncate() n&#34;, ret);goto cleanup;}/* Create VMA */buf = mmap(NULL, TEST_MEM_SIZE,   PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0);if (buf == (void *)-1) {fprintf(stderr, &#34;Unable to mmap &lt;%s&gt; n&#34;, filename);goto cleanup;}fprintf(stdout, &#34;mapped buffer at 0x%p n&#34;, buf);ret = madvise(buf, TEST_MEM_SIZE, MADV_HUGEPAGE);        if (ret) {fprintf(stderr, &#34;Unable to madvise(MADV_HUGEPAGE) n&#34;);goto cleanup;}/* Populate VMA */ret = madvise(buf, TEST_MEM_SIZE, MADV_POPULATE_WRITE);if (ret) {fprintf(stderr, &#34;Error %d to madvise(MADV_POPULATE_WRITE) n&#34;, ret);goto cleanup;}/* Punch the file to enforce xarray split */ret = fallocate(fd, FALLOC_FL_KEEP_SIZE | FALLOC_FL_PUNCH_HOLE,        TEST_MEM_SIZE - pgsize, pgsize);if (ret)fprintf(stderr, &#34;Error %d to fallocate() n&#34;, ret);cleanup:if (buf != (void *)-1)munmap(buf, TEST_MEM_SIZE);if (fd &gt; 0)close(fd);return 0;}# gcc test.c -o test# cat /proc/1/smaps | grep KernelPageSize | head -n 1KernelPageSize:       64 kB# ./test shmem   :------------[ cut here ]------------WARNING: CPU: 17 PID: 5253 at lib/xarray.c:1025 xas_split_alloc+0xf8/0x128Modules linked in: nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib   nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct     nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4     ip_set nf_tables rfkill nfnetlink vfat fat virtio_balloon           drm fuse xfs libcrc32c crct10dif_ce ghash_ce sha2_ce sha256_arm64   virtio_net sha1_ce net_failover failover virtio_console virtio_blk  dimlib virtio_mmioCPU: 17 PID: 5253 Comm: test Kdump: loaded Tainted: G W 6.10.0-rc5-gavin+ #12Hardware name: QEMU KVM Virtual Machine, BIOS edk2-20240524-1.el9 05/24/2024pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)pc : xas_split_
 openEuler评分：
  5.5
 Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-24.03-LTS(6.6.0):受影响
2.openEuler-20.03-LTS-SP4(4.19.90):不受影响
3.openEuler-22.03-LTS-SP1(5.10.0):不受影响
4.openEuler-22.03-LTS-SP3(5.10.0):不受影响
5.openEuler-22.03-LTS-SP4(5.10.0):不受影响
6.master(6.6.0):不受影响
7.openEuler-24.03-LTS-Next(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP4(4.19.90):否
2.openEuler-22.03-LTS-SP1(5.10.0):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.master(6.6.0):否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-22.03-LTS-SP4(5.10.0):否

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2024-2124

src-openEuler/kernel
Closed

Content Risk Flag

Comments (15)

src-openEuler/kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2024-42243

Comments (15)

Search

src-openEuler/kernel
Closed