CVE-2023-52889

一、漏洞信息
 漏洞编号：[CVE-2023-52889](https://nvd.nist.gov/vuln/detail/CVE-2023-52889)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.0,6.1.14,6.1.19,6.1.5,6.1.6,6.1.8,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：5.5 Medium
  Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:apparmor: Fix null pointer deref when receiving skb during sock creationThe panic below is observed when receiving ICMP packets with secmark setwhile an ICMP raw socket is being created. SK_CTX(sk)->label is updatedin apparmor_socket_post_create(), but the packet is delivered to thesocket before that, causing the null pointer dereference.Drop the packet if label context is not set.    BUG: kernel NULL pointer dereference, address: 000000000000004c    #PF: supervisor read access in kernel mode    #PF: error_code(0x0000) - not-present page    PGD 0 P4D 0    Oops: 0000 [#1] PREEMPT SMP NOPTI    CPU: 0 PID: 407 Comm: a.out Not tainted 6.4.12-arch1-1 #1 3e6fa2753a2d75925c34ecb78e22e85a65d083df    Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 05/28/2020    RIP: 0010:aa_label_next_confined+0xb/0x40    Code: 00 00 48 89 ef e8 d5 25 0c 00 e9 66 ff ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 66 0f 1f 00 0f 1f 44 00 00 89 f0 <8b> 77 4c 39 c6 7e 1f 48 63 d0 48 8d 14 d7 eb 0b 83 c0 01 48 83 c2    RSP: 0018:ffffa92940003b08 EFLAGS: 00010246    RAX: 0000000000000000 RBX: 0000000000000000 RCX: 000000000000000e    RDX: ffffa92940003be8 RSI: 0000000000000000 RDI: 0000000000000000    RBP: ffff8b57471e7800 R08: ffff8b574c642400 R09: 0000000000000002    R10: ffffffffbd820eeb R11: ffffffffbeb7ff00 R12: ffff8b574c642400    R13: 0000000000000001 R14: 0000000000000001 R15: 0000000000000000    FS:  00007fb092ea7640(0000) GS:ffff8b577bc00000(0000) knlGS:0000000000000000    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033    CR2: 000000000000004c CR3: 00000001020f2005 CR4: 00000000007706f0    PKRU: 55555554    Call Trace:     <IRQ>     ? __die+0x23/0x70     ? page_fault_oops+0x171/0x4e0     ? exc_page_fault+0x7f/0x180     ? asm_exc_page_fault+0x26/0x30     ? aa_label_next_confined+0xb/0x40     apparmor_secmark_check+0xec/0x330     security_sock_rcv_skb+0x35/0x50     sk_filter_trim_cap+0x47/0x250     sock_queue_rcv_skb_reason+0x20/0x60     raw_rcv+0x13c/0x210     raw_local_deliver+0x1f3/0x250     ip_protocol_deliver_rcu+0x4f/0x2f0     ip_local_deliver_finish+0x76/0xa0     __netif_receive_skb_one_core+0x89/0xa0     netif_receive_skb+0x119/0x170     ? __netdev_alloc_skb+0x3d/0x140     vmxnet3_rq_rx_complete+0xb23/0x1010 [vmxnet3 56a84f9c97178c57a43a24ec073b45a9d6f01f3a]     vmxnet3_poll_rx_only+0x36/0xb0 [vmxnet3 56a84f9c97178c57a43a24ec073b45a9d6f01f3a]     __napi_poll+0x28/0x1b0     net_rx_action+0x2a4/0x380     __do_softirq+0xd1/0x2c8     __irq_exit_rcu+0xbb/0xf0     common_interrupt+0x86/0xa0     </IRQ>     <TASK>     asm_common_interrupt+0x26/0x40    RIP: 0010:apparmor_socket_post_create+0xb/0x200    Code: 08 48 85 ff 75 a1 eb b1 0f 1f 80 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 41 54 <55> 48 89 fd 53 45 85 c0 0f 84 b2 00 00 00 48 8b 1d 80 56 3f 02 48    RSP: 0018:ffffa92940ce7e50 EFLAGS: 00000286    RAX: ffffffffbc756440 RBX: 0000000000000000 RCX: 0000000000000001    RDX: 0000000000000003 RSI: 0000000000000002 RDI: ffff8b574eaab740    RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000    R10: ffff8b57444cec70 R11: 0000000000000000 R12: 0000000000000003    R13: 0000000000000002 R14: ffff8b574eaab740 R15: ffffffffbd8e4748     ? __pfx_apparmor_socket_post_create+0x10/0x10     security_socket_post_create+0x4b/0x80     __sock_create+0x176/0x1f0     __sys_socket+0x89/0x100     __x64_sys_socket+0x17/0x20     do_syscall_64+0x5d/0x90     ? do_syscall_64+0x6c/0x90     ? do_syscall_64+0x6c/0x90     ? do_syscall_64+0x6c/0x90     entry_SYSCALL_64_after_hwframe+0x72/0xdc
 漏洞公开时间：2024-08-17 17:15:07
 漏洞创建时间：2024-08-17 18:09:25
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2023-52889
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/0abe35bc48d4ec80424b1f4b3560c0e082cbd5c1 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/290a6b88e8c19b6636ed1acc733d1458206f7697 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/347dcb84a4874b5fb375092c08d8cc4069b94f81 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/46c17ead5b7389e22e7dc9903fd0ba865d05bda2 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/6c920754f62cefc63fccdc38a062c7c3452e2961 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/ead2ad1d9f045f26fdce3ef1644913b3a6cd38f2 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/fce09ea314505a52f2436397608fa0a5d0934fb1 |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-52889 | https://bugzilla.suse.com/show_bug.cgi?id=1229287 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2023-52889 | https://bugzilla.suse.com/show_bug.cgi?id=1229287 |
| suse_bugzilla | https://git.kernel.org/stable/c/46c17ead5b7389e22e7dc9903fd0ba865d05bda2 | https://bugzilla.suse.com/show_bug.cgi?id=1229287 |
| suse_bugzilla | https://git.kernel.org/stable/c/6c920754f62cefc63fccdc38a062c7c3452e2961 | https://bugzilla.suse.com/show_bug.cgi?id=1229287 |
| suse_bugzilla | https://git.kernel.org/stable/c/ead2ad1d9f045f26fdce3ef1644913b3a6cd38f2 | https://bugzilla.suse.com/show_bug.cgi?id=1229287 |
| suse_bugzilla | https://git.kernel.org/stable/c/fce09ea314505a52f2436397608fa0a5d0934fb1 | https://bugzilla.suse.com/show_bug.cgi?id=1229287 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2023/CVE-2023-52889.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1229287 |
| suse_bugzilla | https://git.kernel.org/stable/c/0abe35bc48d4ec80424b1f4b3560c0e082cbd5c1 | https://bugzilla.suse.com/show_bug.cgi?id=1229287 |
| suse_bugzilla | https://git.kernel.org/stable/c/290a6b88e8c19b6636ed1acc733d1458206f7697 | https://bugzilla.suse.com/show_bug.cgi?id=1229287 |
| suse_bugzilla | https://git.kernel.org/stable/c/347dcb84a4874b5fb375092c08d8cc4069b94f81 | https://bugzilla.suse.com/show_bug.cgi?id=1229287 |
| ubuntu | https://www.cve.org/CVERecord?id=CVE-2023-52889 | https://ubuntu.com/security/CVE-2023-52889 |
| ubuntu | https://git.kernel.org/linus/fce09ea314505a52f2436397608fa0a5d0934fb1 (6.11-rc1) | https://ubuntu.com/security/CVE-2023-52889 |
| ubuntu | https://git.kernel.org/stable/c/ead2ad1d9f045f26fdce3ef1644913b3a6cd38f2 | https://ubuntu.com/security/CVE-2023-52889 |
| ubuntu | https://git.kernel.org/stable/c/6c920754f62cefc63fccdc38a062c7c3452e2961 | https://ubuntu.com/security/CVE-2023-52889 |
| ubuntu | https://git.kernel.org/stable/c/46c17ead5b7389e22e7dc9903fd0ba865d05bda2 | https://ubuntu.com/security/CVE-2023-52889 |
| ubuntu | https://git.kernel.org/stable/c/fce09ea314505a52f2436397608fa0a5d0934fb1 | https://ubuntu.com/security/CVE-2023-52889 |
| ubuntu | https://git.kernel.org/stable/c/0abe35bc48d4ec80424b1f4b3560c0e082cbd5c1 | https://ubuntu.com/security/CVE-2023-52889 |
| ubuntu | https://git.kernel.org/stable/c/347dcb84a4874b5fb375092c08d8cc4069b94f81 | https://ubuntu.com/security/CVE-2023-52889 |
| ubuntu | https://git.kernel.org/stable/c/290a6b88e8c19b6636ed1acc733d1458206f7697 | https://ubuntu.com/security/CVE-2023-52889 |
| ubuntu | https://nvd.nist.gov/vuln/detail/CVE-2023-52889 | https://ubuntu.com/security/CVE-2023-52889 |
| ubuntu | https://launchpad.net/bugs/cve/CVE-2023-52889 | https://ubuntu.com/security/CVE-2023-52889 |
| ubuntu | https://security-tracker.debian.org/tracker/CVE-2023-52889 | https://ubuntu.com/security/CVE-2023-52889 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2023-52889 |
| cve_search |  | https://git.kernel.org/stable/c/ead2ad1d9f045f26fdce3ef1644913b3a6cd38f2 |
| cve_search |  | https://git.kernel.org/stable/c/6c920754f62cefc63fccdc38a062c7c3452e2961 |
| cve_search |  | https://git.kernel.org/stable/c/46c17ead5b7389e22e7dc9903fd0ba865d05bda2 |
| cve_search |  | https://git.kernel.org/stable/c/fce09ea314505a52f2436397608fa0a5d0934fb1 |
| cve_search |  | https://git.kernel.org/stable/c/0abe35bc48d4ec80424b1f4b3560c0e082cbd5c1 |
| cve_search |  | https://git.kernel.org/stable/c/347dcb84a4874b5fb375092c08d8cc4069b94f81 |
| cve_search |  | https://git.kernel.org/stable/c/290a6b88e8c19b6636ed1acc733d1458206f7697 |
| mageia |  | http://advisories.mageia.org/MGASA-2024-0309.html |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://git.kernel.org/stable/c/0abe35bc48d4ec80424b1f4b3560c0e082cbd5c1 |  | nvd |
|  |  | https://git.kernel.org/stable/c/290a6b88e8c19b6636ed1acc733d1458206f7697 |  | nvd |
|  |  | https://git.kernel.org/stable/c/347dcb84a4874b5fb375092c08d8cc4069b94f81 |  | nvd |
|  |  | https://git.kernel.org/stable/c/46c17ead5b7389e22e7dc9903fd0ba865d05bda2 |  | nvd |
|  |  | https://git.kernel.org/stable/c/6c920754f62cefc63fccdc38a062c7c3452e2961 |  | nvd |
|  |  | https://git.kernel.org/stable/c/ead2ad1d9f045f26fdce3ef1644913b3a6cd38f2 |  | nvd |
|  |  | https://git.kernel.org/stable/c/fce09ea314505a52f2436397608fa0a5d0934fb1 |  | nvd |
| linux |  | https://git.kernel.org/linus/fce09ea314505a52f2436397608fa0a5d0934fb1 | https://git.kernel.org/linus/ab9f2115081ab7ba63b77a759e0f3eb5d6463d7f | ubuntu |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:apparmor: Fix null pointer deref when receiving skb during sock creationThe panic below is observed when receiving ICMP packets with secmark setwhile an ICMP raw socket is being created. SK_CTX(sk)->label is updatedin apparmor_socket_post_create(), but the packet is delivered to thesocket before that, causing the null pointer dereference.Drop the packet if label context is not set.    BUG: kernel NULL pointer dereference, address: 000000000000004c    #PF: supervisor read access in kernel mode    #PF: error_code(0x0000) - not-present page    PGD 0 P4D 0    Oops: 0000 [#1] PREEMPT SMP NOPTI    CPU: 0 PID: 407 Comm: a.out Not tainted 6.4.12-arch1-1 #1 3e6fa2753a2d75925c34ecb78e22e85a65d083df    Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 05/28/2020    RIP: 0010:aa_label_next_confined+0xb/0x40    Code: 00 00 48 89 ef e8 d5 25 0c 00 e9 66 ff ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 66 0f 1f 00 0f 1f 44 00 00 89 f0 <8b> 77 4c 39 c6 7e 1f 48 63 d0 48 8d 14 d7 eb 0b 83 c0 01 48 83 c2    RSP: 0018:ffffa92940003b08 EFLAGS: 00010246    RAX: 0000000000000000 RBX: 0000000000000000 RCX: 000000000000000e    RDX: ffffa92940003be8 RSI: 0000000000000000 RDI: 0000000000000000    RBP: ffff8b57471e7800 R08: ffff8b574c642400 R09: 0000000000000002    R10: ffffffffbd820eeb R11: ffffffffbeb7ff00 R12: ffff8b574c642400    R13: 0000000000000001 R14: 0000000000000001 R15: 0000000000000000    FS:  00007fb092ea7640(0000) GS:ffff8b577bc00000(0000) knlGS:0000000000000000    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033    CR2: 000000000000004c CR3: 00000001020f2005 CR4: 00000000007706f0    PKRU: 55555554    Call Trace:     <IRQ>     ? __die+0x23/0x70     ? page_fault_oops+0x171/0x4e0     ? exc_page_fault+0x7f/0x180     ? asm_exc_page_fault+0x26/0x30     ? aa_label_next_confined+0xb/0x40     apparmor_secmark_check+0xec/0x330     security_sock_rcv_skb+0x35/0x50     sk_filter_trim_cap+0x47/0x250     sock_queue_rcv_skb_reason+0x20/0x60     raw_rcv+0x13c/0x210     raw_local_deliver+0x1f3/0x250     ip_protocol_deliver_rcu+0x4f/0x2f0     ip_local_deliver_finish+0x76/0xa0     __netif_receive_skb_one_core+0x89/0xa0     netif_receive_skb+0x119/0x170     ? __netdev_alloc_skb+0x3d/0x140     vmxnet3_rq_rx_complete+0xb23/0x1010 [vmxnet3 56a84f9c97178c57a43a24ec073b45a9d6f01f3a]     vmxnet3_poll_rx_only+0x36/0xb0 [vmxnet3 56a84f9c97178c57a43a24ec073b45a9d6f01f3a]     __napi_poll+0x28/0x1b0     net_rx_action+0x2a4/0x380     __do_softirq+0xd1/0x2c8     __irq_exit_rcu+0xbb/0xf0     common_interrupt+0x86/0xa0     </IRQ>     <TASK>     asm_common_interrupt+0x26/0x40    RIP: 0010:apparmor_socket_post_create+0xb/0x200    Code: 08 48 85 ff 75 a1 eb b1 0f 1f 80 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 41 54 <55> 48 89 fd 53 45 85 c0 0f 84 b2 00 00 00 48 8b 1d 80 56 3f 02 48    RSP: 0018:ffffa92940ce7e50 EFLAGS: 00000286    RAX: ffffffffbc756440 RBX: 0000000000000000 RCX: 0000000000000001    RDX: 0000000000000003 RSI: 0000000000000002 RDI: ffff8b574eaab740    RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000    R10: ffff8b57444cec70 R11: 0000000000000000 R12: 0000000000000003    R13: 0000000000000002 R14: ffff8b574eaab740 R15: ffffffffbd8e4748     ? __pfx_apparmor_socket_post_create+0x10/0x10     security_socket_post_create+0x4b/0x80     __sock_create+0x176/0x1f0     __sys_socket+0x89/0x100     __x64_sys_socket+0x17/0x20     do_syscall_64+0x5d/0x90     ? do_syscall_64+0x6c/0x90     ? do_syscall_64+0x6c/0x90     ? do_syscall_64+0x6c/0x90     entry_SYSCALL_64_after_hwframe+0x72/0xdc
 openEuler评分：
  5.5
 Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-22.03-LTS-SP1(5.10.0):受影响
2.openEuler-22.03-LTS-SP3(5.10.0):受影响
3.openEuler-22.03-LTS-SP4(5.10.0):受影响
4.openEuler-24.03-LTS(6.6.0):受影响
5.openEuler-20.03-LTS-SP4(4.19.90):不受影响
6.master(6.6.0):不受影响
7.openEuler-24.03-LTS-Next(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP4(4.19.90):否
2.openEuler-22.03-LTS-SP1(5.10.0):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.master(6.6.0):否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-22.03-LTS-SP4(5.10.0):否

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2024-2296

Hi openeuler-ci-bot, welcome to the openEuler Community.
I'm the Bot here serving you. You can find the instructions on how to interact with me at Here.
If you have any questions, please contact the SIG: Kernel, and any of the maintainers.

@yangyingliang ,@jiaoff ,@guohaocs2c ,@hanjun-guo ,@woqidaideshi ,@newbeats ,@zhangyi089 ,@colyli ,@thundertown ,@htforge ,@chiqijun ,@lengchao ,@zhujianwei001 ,@kylin-mayukun ,@wangxiongfeng ,@wkfxxx ,@SuperSix173 ,@jentlestea ,@oskernel0719 ,@gasonchen 
**issue处理注意事项:** 
**1. 当前issue受影响的分支提交pr时, 须在pr描述中填写当前issue编号进行关联, 否则无法关闭当前issue;**
**2. 模板内容需要填写完整, 无论是受影响或者不受影响都需要填写完整内容,未引入的分支不需要填写, 否则无法关闭当前issue;**
**3. 以下为模板中需要填写完整的内容, 请复制到评论区回复, 注: 内容的标题名称(影响性分析说明, openEuler评分, 受影响版本排查(受影响/不受影响), 修复是否涉及abi变化(是/否))不能省略,省略后cve-manager将无法正常解析填写内容.**
************************************************************************
影响性分析说明:

openEuler评分: (评分和向量)

受影响版本排查(受影响/不受影响): 
1.master(6.1.0):
2.openEuler-20.03-LTS-SP4(4.19.90):
3.openEuler-22.03-LTS-SP1(5.10.0):
4.openEuler-22.03-LTS-SP3(5.10.0):
5.openEuler-22.03-LTS-SP4(5.10.0):
6.openEuler-24.03-LTS(6.6.0):
7.openEuler-24.03-LTS-Next(6.6.0):

修复是否涉及abi变化(是/否)：
1.master(6.1.0):
2.openEuler-20.03-LTS-SP4(4.19.90):
3.openEuler-22.03-LTS-SP1(5.10.0):
4.openEuler-22.03-LTS-SP3(5.10.0):
5.openEuler-22.03-LTS-SP4(5.10.0):
6.openEuler-24.03-LTS(6.6.0):
7.openEuler-24.03-LTS-Next(6.6.0):

-----------------------------------------------------------------------
issue处理具体操作请参考: 
https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
pr关联issue具体操作请参考:
https://gitee.com/help/articles/4142

参考网址	关联pr	状态	补丁链接
https://nvd.nist.gov/vuln/detail/CVE-2023-52889	None	None	https://git.kernel.org/stable/c/fce09ea314505a52f2436397608fa0a5d0934fb1 https://git.kernel.org/stable/c/46c17ead5b7389e22e7dc9903fd0ba865d05bda2 https://git.kernel.org/stable/c/6c920754f62cefc63fccdc38a062c7c3452e2961 https://git.kernel.org/stable/c/ead2ad1d9f045f26fdce3ef1644913b3a6cd38f2
https://ubuntu.com/security/CVE-2023-52889	None	None	https://discourse.ubuntu.com/c/ubuntu-pro
https://www.opencve.io/cve/CVE-2023-52889	None	None	https://git.kernel.org/stable/c/fce09ea314505a52f2436397608fa0a5d0934fb1 https://git.kernel.org/stable/c/46c17ead5b7389e22e7dc9903fd0ba865d05bda2 https://git.kernel.org/stable/c/6c920754f62cefc63fccdc38a062c7c3452e2961 https://git.kernel.org/stable/c/ead2ad1d9f045f26fdce3ef1644913b3a6cd38f2
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2023-52889
https://security-tracker.debian.org/tracker/CVE-2023-52889	None	None	https://git.kernel.org/linus/fce09ea314505a52f2436397608fa0a5d0934fb1

说明：补丁链接仅供初步排查参考，实际可用性请人工再次确认，补丁下载验证可使用CVE补丁工具。
若补丁不准确，烦请在此issue下评论 '/report-patch 参考网址补丁链接1,补丁链接2' 反馈正确信息，便于我们不断优化工具，不胜感激。
如 /report-patch https://security-tracker.debian.org/tracker/CVE-2021-3997 https://github.com/systemd/systemd/commit/5b1cf7a9be37e20133c0208005274ce4a5b5c6a1

CVE-2023-52889

影响性分析说明：
In the Linux kernel, the following vulnerability has been resolved:

apparmor: Fix null pointer deref when receiving skb during sock creation

The panic below is observed when receiving ICMP packets with secmark set
while an ICMP raw socket is being created. SK_CTX(sk)->label is updated
in apparmor_socket_post_create(), but the packet is delivered to the
socket before that, causing the null pointer dereference.
Drop the packet if label context is not set.

BUG: kernel NULL pointer dereference, address: 000000000000004c
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 0 P4D 0
Oops: 0000 [#1] PREEMPT SMP NOPTI
CPU: 0 PID: 407 Comm: a.out Not tainted 6.4.12-arch1-1 #1 3e6fa2753a2d75925c34ecb78e22e85a65d083df
Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 05/28/2020
RIP: 0010:aa_label_next_confined+0xb/0x40
Code: 00 00 48 89 ef e8 d5 25 0c 00 e9 66 ff ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 66 0f 1f 00 0f 1f 44 00 00 89 f0 &lt;8b&gt; 77 4c 39 c6 7e 1f 48 63 d0 48 8d 14 d7 eb 0b 83 c0 01 48 83 c2
RSP: 0018:ffffa92940003b08 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 000000000000000e
RDX: ffffa92940003be8 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffff8b57471e7800 R08: ffff8b574c642400 R09: 0000000000000002
R10: ffffffffbd820eeb R11: ffffffffbeb7ff00 R12: ffff8b574c642400
R13: 0000000000000001 R14: 0000000000000001 R15: 0000000000000000
FS:  00007fb092ea7640(0000) GS:ffff8b577bc00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000000004c CR3: 00000001020f2005 CR4: 00000000007706f0
PKRU: 55555554
Call Trace:
 &lt;IRQ&gt;
 ? __die+0x23/0x70
 ? page_fault_oops+0x171/0x4e0
 ? exc_page_fault+0x7f/0x180
 ? asm_exc_page_fault+0x26/0x30
 ? aa_label_next_confined+0xb/0x40
 apparmor_secmark_check+0xec/0x330
 security_sock_rcv_skb+0x35/0x50
 sk_filter_trim_cap+0x47/0x250
 sock_queue_rcv_skb_reason+0x20/0x60
 raw_rcv+0x13c/0x210
 raw_local_deliver+0x1f3/0x250
 ip_protocol_deliver_rcu+0x4f/0x2f0
 ip_local_deliver_finish+0x76/0xa0
 __netif_receive_skb_one_core+0x89/0xa0
 netif_receive_skb+0x119/0x170
 ? __netdev_alloc_skb+0x3d/0x140
 vmxnet3_rq_rx_complete+0xb23/0x1010 [vmxnet3 56a84f9c97178c57a43a24ec073b45a9d6f01f3a]
 vmxnet3_poll_rx_only+0x36/0xb0 [vmxnet3 56a84f9c97178c57a43a24ec073b45a9d6f01f3a]
 __napi_poll+0x28/0x1b0
 net_rx_action+0x2a4/0x380
 __do_softirq+0xd1/0x2c8
 __irq_exit_rcu+0xbb/0xf0
 common_interrupt+0x86/0xa0
 &lt;/IRQ&gt;
 &lt;TASK&gt;
 asm_common_interrupt+0x26/0x40
RIP: 0010:apparmor_socket_post_create+0xb/0x200
Code: 08 48 85 ff 75 a1 eb b1 0f 1f 80 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 41 54 &lt;55&gt; 48 89 fd 53 45 85 c0 0f 84 b2 00 00 00 48 8b 1d 80 56 3f 02 48
RSP: 0018:ffffa92940ce7e50 EFLAGS: 00000286
RAX: ffffffffbc756440 RBX: 0000000000000000 RCX: 0000000000000001
RDX: 0000000000000003 RSI: 0000000000000002 RDI: ffff8b574eaab740
RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000
R10: ffff8b57444cec70 R11: 0000000000000000 R12: 0000000000000003
R13: 0000000000000002 R14: ffff8b574eaab740 R15: ffffffffbd8e4748
 ? __pfx_apparmor_socket_post_create+0x10/0x10
 security_socket_post_create+0x4b/0x80
 __sock_create+0x176/0x1f0
 __sys_socket+0x89/0x100
 __x64_sys_socket+0x17/0x20
 do_syscall_64+0x5d/0x90
 ? do_syscall_64+0x6c/0x90
 ? do_syscall_64+0x6c/0x90
 ? do_syscall_64+0x6c/0x90
 entry_SYSCALL_64_after_hwframe+0x72/0xdc

The Linux kernel CVE team has assigned CVE-2023-52889 to this issue.

openEuler评分:(评分和向量)
3.9
AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L

受影响版本排查(受影响/不受影响):
1.openEuler-20.03-LTS-SP4:不受影响
2.openEuler-22.03-LTS-SP1:不受影响
3.openEuler-22.03-LTS-SP3:不受影响
4.openEuler-22.03-LTS-SP4:不受影响
5.master(6.1.0):不受影响
6.openEuler-24.03-LTS:不受影响
7.openEuler-24.03-LTS-Next:不受影响

修复是否涉及abi变化(是/否)：
1.openEuler-20.03-LTS-SP4:否
2.openEuler-22.03-LTS-SP1:否
3.openEuler-22.03-LTS-SP3:否
4.master(6.1.0):否
5.openEuler-24.03-LTS:否
6.openEuler-24.03-LTS-Next:否
7.openEuler-22.03-LTS-SP4:否

@ 经过 cve-manager 解析, 已分析的内容如下表所示:
| 状态  | 需分析 | 内容 |
|:--:|:--:|---------|
|已分析|1.影响性分析说明|In the Linux kernel, the following vulnerability has been resolved:apparmor: Fix null pointer deref when receiving skb during sock creationThe panic below is observed when receiving ICMP packets with secmark setwhile an ICMP raw socket is being created. SK_CTX(sk)-&gt;label is updatedin apparmor_socket_post_create(), but the packet is delivered to thesocket before that, causing the null pointer dereference.Drop the packet if label context is not set.    BUG: kernel NULL pointer dereference, address: 000000000000004c    #PF: supervisor read access in kernel mode    #PF: error_code(0x0000) - not-present page    PGD 0 P4D 0    Oops: 0000 [#1] PREEMPT SMP NOPTI    CPU: 0 PID: 407 Comm: a.out Not tainted 6.4.12-arch1-1 #1 3e6fa2753a2d75925c34ecb78e22e85a65d083df    Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 05/28/2020    RIP: 0010:aa_label_next_confined+0xb/0x40    Code: 00 00 48 89 ef e8 d5 25 0c 00 e9 66 ff ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 66 0f 1f 00 0f 1f 44 00 00 89 f0 &lt;8b&gt; 77 4c 39 c6 7e 1f 48 63 d0 48 8d 14 d7 eb 0b 83 c0 01 48 83 c2    RSP: 0018:ffffa92940003b08 EFLAGS: 00010246    RAX: 0000000000000000 RBX: 0000000000000000 RCX: 000000000000000e    RDX: ffffa92940003be8 RSI: 0000000000000000 RDI: 0000000000000000    RBP: ffff8b57471e7800 R08: ffff8b574c642400 R09: 0000000000000002    R10: ffffffffbd820eeb R11: ffffffffbeb7ff00 R12: ffff8b574c642400    R13: 0000000000000001 R14: 0000000000000001 R15: 0000000000000000    FS:  00007fb092ea7640(0000) GS:ffff8b577bc00000(0000) knlGS:0000000000000000    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033    CR2: 000000000000004c CR3: 00000001020f2005 CR4: 00000000007706f0    PKRU: 55555554    Call Trace:     &lt;IRQ&gt;     ? __die+0x23/0x70     ? page_fault_oops+0x171/0x4e0     ? exc_page_fault+0x7f/0x180     ? asm_exc_page_fault+0x26/0x30     ? aa_label_next_confined+0xb/0x40     apparmor_secmark_check+0xec/0x330     security_sock_rcv_skb+0x35/0x50     sk_filter_trim_cap+0x47/0x250     sock_queue_rcv_skb_reason+0x20/0x60     raw_rcv+0x13c/0x210     raw_local_deliver+0x1f3/0x250     ip_protocol_deliver_rcu+0x4f/0x2f0     ip_local_deliver_finish+0x76/0xa0     __netif_receive_skb_one_core+0x89/0xa0     netif_receive_skb+0x119/0x170     ? __netdev_alloc_skb+0x3d/0x140     vmxnet3_rq_rx_complete+0xb23/0x1010 [vmxnet3 56a84f9c97178c57a43a24ec073b45a9d6f01f3a]     vmxnet3_poll_rx_only+0x36/0xb0 [vmxnet3 56a84f9c97178c57a43a24ec073b45a9d6f01f3a]     __napi_poll+0x28/0x1b0     net_rx_action+0x2a4/0x380     __do_softirq+0xd1/0x2c8     __irq_exit_rcu+0xbb/0xf0     common_interrupt+0x86/0xa0     &lt;/IRQ&gt;     &lt;TASK&gt;     asm_common_interrupt+0x26/0x40    RIP: 0010:apparmor_socket_post_create+0xb/0x200    Code: 08 48 85 ff 75 a1 eb b1 0f 1f 80 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 41 54 &lt;55&gt; 48 89 fd 53 45 85 c0 0f 84 b2 00 00 00 48 8b 1d 80 56 3f 02 48    RSP: 0018:ffffa92940ce7e50 EFLAGS: 00000286    RAX: ffffffffbc756440 RBX: 0000000000000000 RCX: 0000000000000001    RDX: 0000000000000003 RSI: 0000000000000002 RDI: ffff8b574eaab740    RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000    R10: ffff8b57444cec70 R11: 0000000000000000 R12: 0000000000000003    R13: 0000000000000002 R14: ffff8b574eaab740 R15: ffffffffbd8e4748     ? __pfx_apparmor_socket_post_create+0x10/0x10     security_socket_post_create+0x4b/0x80     __sock_create+0x176/0x1f0     __sys_socket+0x89/0x100     __x64_sys_socket+0x17/0x20     do_syscall_64+0x5d/0x90     ? do_syscall_64+0x6c/0x90     ? do_syscall_64+0x6c/0x90     ? do_syscall_64+0x6c/0x90     entry_SYSCALL_64_after_hwframe+0x72/0xdcThe Linux kernel CVE team has assigned CVE-2023-52889 to this issue.|
|已分析|2.openEulerScore|3.9|
|已分析|3.openEulerVector|AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L|
|已分析|4.受影响版本排查|openEuler-20.03-LTS-SP4:不受影响,openEuler-22.03-LTS-SP1:不受影响,openEuler-22.03-LTS-SP3:不受影响,openEuler-22.03-LTS-SP4:不受影响,master:不受影响,openEuler-24.03-LTS:不受影响,openEuler-24.03-LTS-Next:不受影响|
|已分析|5.修复是否涉及abi变化|openEuler-20.03-LTS-SP4:否,openEuler-22.03-LTS-SP1:否,openEuler-22.03-LTS-SP3:否,master:否,openEuler-24.03-LTS:否,openEuler-24.03-LTS-Next:否,openEuler-22.03-LTS-SP4:否|

**请确认分析内容的准确性, 确认无误后, 您可以进行后续步骤, 否则您可以继续分析.**

CVE-2023-52889

影响性分析说明：
In the Linux kernel, the following vulnerability has been resolved:

apparmor: Fix null pointer deref when receiving skb during sock creation

The panic below is observed when receiving ICMP packets with secmark set
while an ICMP raw socket is being created. SK_CTX(sk)->label is updated
in apparmor_socket_post_create(), but the packet is delivered to the
socket before that, causing the null pointer dereference.
Drop the packet if label context is not set.

BUG: kernel NULL pointer dereference, address: 000000000000004c
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 0 P4D 0
Oops: 0000 [#1] PREEMPT SMP NOPTI
CPU: 0 PID: 407 Comm: a.out Not tainted 6.4.12-arch1-1 #1 3e6fa2753a2d75925c34ecb78e22e85a65d083df
Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 05/28/2020
RIP: 0010:aa_label_next_confined+0xb/0x40
Code: 00 00 48 89 ef e8 d5 25 0c 00 e9 66 ff ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 66 0f 1f 00 0f 1f 44 00 00 89 f0 &lt;8b&gt; 77 4c 39 c6 7e 1f 48 63 d0 48 8d 14 d7 eb 0b 83 c0 01 48 83 c2
RSP: 0018:ffffa92940003b08 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 000000000000000e
RDX: ffffa92940003be8 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffff8b57471e7800 R08: ffff8b574c642400 R09: 0000000000000002
R10: ffffffffbd820eeb R11: ffffffffbeb7ff00 R12: ffff8b574c642400
R13: 0000000000000001 R14: 0000000000000001 R15: 0000000000000000
FS:  00007fb092ea7640(0000) GS:ffff8b577bc00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000000004c CR3: 00000001020f2005 CR4: 00000000007706f0
PKRU: 55555554
Call Trace:
 &lt;IRQ&gt;
 ? __die+0x23/0x70
 ? page_fault_oops+0x171/0x4e0
 ? exc_page_fault+0x7f/0x180
 ? asm_exc_page_fault+0x26/0x30
 ? aa_label_next_confined+0xb/0x40
 apparmor_secmark_check+0xec/0x330
 security_sock_rcv_skb+0x35/0x50
 sk_filter_trim_cap+0x47/0x250
 sock_queue_rcv_skb_reason+0x20/0x60
 raw_rcv+0x13c/0x210
 raw_local_deliver+0x1f3/0x250
 ip_protocol_deliver_rcu+0x4f/0x2f0
 ip_local_deliver_finish+0x76/0xa0
 __netif_receive_skb_one_core+0x89/0xa0
 netif_receive_skb+0x119/0x170
 ? __netdev_alloc_skb+0x3d/0x140
 vmxnet3_rq_rx_complete+0xb23/0x1010 [vmxnet3 56a84f9c97178c57a43a24ec073b45a9d6f01f3a]
 vmxnet3_poll_rx_only+0x36/0xb0 [vmxnet3 56a84f9c97178c57a43a24ec073b45a9d6f01f3a]
 __napi_poll+0x28/0x1b0
 net_rx_action+0x2a4/0x380
 __do_softirq+0xd1/0x2c8
 __irq_exit_rcu+0xbb/0xf0
 common_interrupt+0x86/0xa0
 &lt;/IRQ&gt;
 &lt;TASK&gt;
 asm_common_interrupt+0x26/0x40
RIP: 0010:apparmor_socket_post_create+0xb/0x200
Code: 08 48 85 ff 75 a1 eb b1 0f 1f 80 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 41 54 &lt;55&gt; 48 89 fd 53 45 85 c0 0f 84 b2 00 00 00 48 8b 1d 80 56 3f 02 48
RSP: 0018:ffffa92940ce7e50 EFLAGS: 00000286
RAX: ffffffffbc756440 RBX: 0000000000000000 RCX: 0000000000000001
RDX: 0000000000000003 RSI: 0000000000000002 RDI: ffff8b574eaab740
RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000
R10: ffff8b57444cec70 R11: 0000000000000000 R12: 0000000000000003
R13: 0000000000000002 R14: ffff8b574eaab740 R15: ffffffffbd8e4748
 ? __pfx_apparmor_socket_post_create+0x10/0x10
 security_socket_post_create+0x4b/0x80
 __sock_create+0x176/0x1f0
 __sys_socket+0x89/0x100
 __x64_sys_socket+0x17/0x20
 do_syscall_64+0x5d/0x90
 ? do_syscall_64+0x6c/0x90
 ? do_syscall_64+0x6c/0x90
 ? do_syscall_64+0x6c/0x90
 entry_SYSCALL_64_after_hwframe+0x72/0xdc

The Linux kernel CVE team has assigned CVE-2023-52889 to this issue.

openEuler评分:(评分和向量)
3.9
AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L

受影响版本排查(受影响/不受影响):
1.openEuler-20.03-LTS-SP4:不受影响
2.openEuler-22.03-LTS-SP1:不受影响
3.openEuler-22.03-LTS-SP3:不受影响
4.openEuler-22.03-LTS-SP4:不受影响
5.master(6.1.0):不受影响
6.openEuler-24.03-LTS:不受影响
7.openEuler-24.03-LTS-Next:不受影响

修复是否涉及abi变化(是/否)：
1.openEuler-20.03-LTS-SP4:否
2.openEuler-22.03-LTS-SP1:否
3.openEuler-22.03-LTS-SP3:否
4.master(6.1.0):否
5.openEuler-24.03-LTS:否
6.openEuler-24.03-LTS-Next:否
7.openEuler-22.03-LTS-SP4:否

CVE-2023-52889

影响性分析说明：
In the Linux kernel, the following vulnerability has been resolved:

apparmor: Fix null pointer deref when receiving skb during sock creation

The panic below is observed when receiving ICMP packets with secmark set
while an ICMP raw socket is being created. SK_CTX(sk)->label is updated
in apparmor_socket_post_create(), but the packet is delivered to the
socket before that, causing the null pointer dereference.
Drop the packet if label context is not set.

BUG: kernel NULL pointer dereference, address: 000000000000004c
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 0 P4D 0
Oops: 0000 [#1] PREEMPT SMP NOPTI
CPU: 0 PID: 407 Comm: a.out Not tainted 6.4.12-arch1-1 #1 3e6fa2753a2d75925c34ecb78e22e85a65d083df
Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 05/28/2020
RIP: 0010:aa_label_next_confined+0xb/0x40
Code: 00 00 48 89 ef e8 d5 25 0c 00 e9 66 ff ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 66 0f 1f 00 0f 1f 44 00 00 89 f0 &lt;8b&gt; 77 4c 39 c6 7e 1f 48 63 d0 48 8d 14 d7 eb 0b 83 c0 01 48 83 c2
RSP: 0018:ffffa92940003b08 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 000000000000000e
RDX: ffffa92940003be8 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffff8b57471e7800 R08: ffff8b574c642400 R09: 0000000000000002
R10: ffffffffbd820eeb R11: ffffffffbeb7ff00 R12: ffff8b574c642400
R13: 0000000000000001 R14: 0000000000000001 R15: 0000000000000000
FS:  00007fb092ea7640(0000) GS:ffff8b577bc00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000000004c CR3: 00000001020f2005 CR4: 00000000007706f0
PKRU: 55555554
Call Trace:
 &lt;IRQ&gt;
 ? __die+0x23/0x70
 ? page_fault_oops+0x171/0x4e0
 ? exc_page_fault+0x7f/0x180
 ? asm_exc_page_fault+0x26/0x30
 ? aa_label_next_confined+0xb/0x40
 apparmor_secmark_check+0xec/0x330
 security_sock_rcv_skb+0x35/0x50
 sk_filter_trim_cap+0x47/0x250
 sock_queue_rcv_skb_reason+0x20/0x60
 raw_rcv+0x13c/0x210
 raw_local_deliver+0x1f3/0x250
 ip_protocol_deliver_rcu+0x4f/0x2f0
 ip_local_deliver_finish+0x76/0xa0
 __netif_receive_skb_one_core+0x89/0xa0
 netif_receive_skb+0x119/0x170
 ? __netdev_alloc_skb+0x3d/0x140
 vmxnet3_rq_rx_complete+0xb23/0x1010 [vmxnet3 56a84f9c97178c57a43a24ec073b45a9d6f01f3a]
 vmxnet3_poll_rx_only+0x36/0xb0 [vmxnet3 56a84f9c97178c57a43a24ec073b45a9d6f01f3a]
 __napi_poll+0x28/0x1b0
 net_rx_action+0x2a4/0x380
 __do_softirq+0xd1/0x2c8
 __irq_exit_rcu+0xbb/0xf0
 common_interrupt+0x86/0xa0
 &lt;/IRQ&gt;
 &lt;TASK&gt;
 asm_common_interrupt+0x26/0x40
RIP: 0010:apparmor_socket_post_create+0xb/0x200
Code: 08 48 85 ff 75 a1 eb b1 0f 1f 80 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 41 54 &lt;55&gt; 48 89 fd 53 45 85 c0 0f 84 b2 00 00 00 48 8b 1d 80 56 3f 02 48
RSP: 0018:ffffa92940ce7e50 EFLAGS: 00000286
RAX: ffffffffbc756440 RBX: 0000000000000000 RCX: 0000000000000001
RDX: 0000000000000003 RSI: 0000000000000002 RDI: ffff8b574eaab740
RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000
R10: ffff8b57444cec70 R11: 0000000000000000 R12: 0000000000000003
R13: 0000000000000002 R14: ffff8b574eaab740 R15: ffffffffbd8e4748
 ? __pfx_apparmor_socket_post_create+0x10/0x10
 security_socket_post_create+0x4b/0x80
 __sock_create+0x176/0x1f0
 __sys_socket+0x89/0x100
 __x64_sys_socket+0x17/0x20
 do_syscall_64+0x5d/0x90
 ? do_syscall_64+0x6c/0x90
 ? do_syscall_64+0x6c/0x90
 ? do_syscall_64+0x6c/0x90
 entry_SYSCALL_64_after_hwframe+0x72/0xdc

The Linux kernel CVE team has assigned CVE-2023-52889 to this issue.

openEuler评分:(评分和向量)
5.5
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

受影响版本排查(受影响/不受影响):
1.openEuler-20.03-LTS-SP4:不受影响
2.openEuler-22.03-LTS-SP1:不受影响
3.openEuler-22.03-LTS-SP3:不受影响
4.openEuler-22.03-LTS-SP4:不受影响
5.master(6.1.0):不受影响
6.openEuler-24.03-LTS:不受影响
7.openEuler-24.03-LTS-Next:不受影响

修复是否涉及abi变化(是/否)：
1.openEuler-20.03-LTS-SP4:否
2.openEuler-22.03-LTS-SP1:否
3.openEuler-22.03-LTS-SP3:否
4.master(6.1.0):否
5.openEuler-24.03-LTS:否
6.openEuler-24.03-LTS-Next:否
7.openEuler-22.03-LTS-SP4:否

@ 经过 cve-manager 解析, 已分析的内容如下表所示:
| 状态  | 需分析 | 内容 |
|:--:|:--:|---------|
|已分析|1.影响性分析说明|In the Linux kernel, the following vulnerability has been resolved:apparmor: Fix null pointer deref when receiving skb during sock creationThe panic below is observed when receiving ICMP packets with secmark setwhile an ICMP raw socket is being created. SK_CTX(sk)-&gt;label is updatedin apparmor_socket_post_create(), but the packet is delivered to thesocket before that, causing the null pointer dereference.Drop the packet if label context is not set.    BUG: kernel NULL pointer dereference, address: 000000000000004c    #PF: supervisor read access in kernel mode    #PF: error_code(0x0000) - not-present page    PGD 0 P4D 0    Oops: 0000 [#1] PREEMPT SMP NOPTI    CPU: 0 PID: 407 Comm: a.out Not tainted 6.4.12-arch1-1 #1 3e6fa2753a2d75925c34ecb78e22e85a65d083df    Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 05/28/2020    RIP: 0010:aa_label_next_confined+0xb/0x40    Code: 00 00 48 89 ef e8 d5 25 0c 00 e9 66 ff ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 66 0f 1f 00 0f 1f 44 00 00 89 f0 &lt;8b&gt; 77 4c 39 c6 7e 1f 48 63 d0 48 8d 14 d7 eb 0b 83 c0 01 48 83 c2    RSP: 0018:ffffa92940003b08 EFLAGS: 00010246    RAX: 0000000000000000 RBX: 0000000000000000 RCX: 000000000000000e    RDX: ffffa92940003be8 RSI: 0000000000000000 RDI: 0000000000000000    RBP: ffff8b57471e7800 R08: ffff8b574c642400 R09: 0000000000000002    R10: ffffffffbd820eeb R11: ffffffffbeb7ff00 R12: ffff8b574c642400    R13: 0000000000000001 R14: 0000000000000001 R15: 0000000000000000    FS:  00007fb092ea7640(0000) GS:ffff8b577bc00000(0000) knlGS:0000000000000000    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033    CR2: 000000000000004c CR3: 00000001020f2005 CR4: 00000000007706f0    PKRU: 55555554    Call Trace:     &lt;IRQ&gt;     ? __die+0x23/0x70     ? page_fault_oops+0x171/0x4e0     ? exc_page_fault+0x7f/0x180     ? asm_exc_page_fault+0x26/0x30     ? aa_label_next_confined+0xb/0x40     apparmor_secmark_check+0xec/0x330     security_sock_rcv_skb+0x35/0x50     sk_filter_trim_cap+0x47/0x250     sock_queue_rcv_skb_reason+0x20/0x60     raw_rcv+0x13c/0x210     raw_local_deliver+0x1f3/0x250     ip_protocol_deliver_rcu+0x4f/0x2f0     ip_local_deliver_finish+0x76/0xa0     __netif_receive_skb_one_core+0x89/0xa0     netif_receive_skb+0x119/0x170     ? __netdev_alloc_skb+0x3d/0x140     vmxnet3_rq_rx_complete+0xb23/0x1010 [vmxnet3 56a84f9c97178c57a43a24ec073b45a9d6f01f3a]     vmxnet3_poll_rx_only+0x36/0xb0 [vmxnet3 56a84f9c97178c57a43a24ec073b45a9d6f01f3a]     __napi_poll+0x28/0x1b0     net_rx_action+0x2a4/0x380     __do_softirq+0xd1/0x2c8     __irq_exit_rcu+0xbb/0xf0     common_interrupt+0x86/0xa0     &lt;/IRQ&gt;     &lt;TASK&gt;     asm_common_interrupt+0x26/0x40    RIP: 0010:apparmor_socket_post_create+0xb/0x200    Code: 08 48 85 ff 75 a1 eb b1 0f 1f 80 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 41 54 &lt;55&gt; 48 89 fd 53 45 85 c0 0f 84 b2 00 00 00 48 8b 1d 80 56 3f 02 48    RSP: 0018:ffffa92940ce7e50 EFLAGS: 00000286    RAX: ffffffffbc756440 RBX: 0000000000000000 RCX: 0000000000000001    RDX: 0000000000000003 RSI: 0000000000000002 RDI: ffff8b574eaab740    RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000    R10: ffff8b57444cec70 R11: 0000000000000000 R12: 0000000000000003    R13: 0000000000000002 R14: ffff8b574eaab740 R15: ffffffffbd8e4748     ? __pfx_apparmor_socket_post_create+0x10/0x10     security_socket_post_create+0x4b/0x80     __sock_create+0x176/0x1f0     __sys_socket+0x89/0x100     __x64_sys_socket+0x17/0x20     do_syscall_64+0x5d/0x90     ? do_syscall_64+0x6c/0x90     ? do_syscall_64+0x6c/0x90     ? do_syscall_64+0x6c/0x90     entry_SYSCALL_64_after_hwframe+0x72/0xdcThe Linux kernel CVE team has assigned CVE-2023-52889 to this issue.|
|已分析|2.openEulerScore|5.5|
|已分析|3.openEulerVector|AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H|
|已分析|4.受影响版本排查|openEuler-20.03-LTS-SP4:不受影响,openEuler-22.03-LTS-SP1:不受影响,openEuler-22.03-LTS-SP3:不受影响,openEuler-22.03-LTS-SP4:不受影响,master:不受影响,openEuler-24.03-LTS:不受影响,openEuler-24.03-LTS-Next:不受影响|
|已分析|5.修复是否涉及abi变化|openEuler-20.03-LTS-SP4:否,openEuler-22.03-LTS-SP1:否,openEuler-22.03-LTS-SP3:否,master:否,openEuler-24.03-LTS:否,openEuler-24.03-LTS-Next:否,openEuler-22.03-LTS-SP4:否|

**请确认分析内容的准确性, 确认无误后, 您可以进行后续步骤, 否则您可以继续分析.**

CVE-2023-52889

影响性分析说明：
In the Linux kernel, the following vulnerability has been resolved:

apparmor: Fix null pointer deref when receiving skb during sock creation

The panic below is observed when receiving ICMP packets with secmark set
while an ICMP raw socket is being created. SK_CTX(sk)->label is updated
in apparmor_socket_post_create(), but the packet is delivered to the
socket before that, causing the null pointer dereference.
Drop the packet if label context is not set.

BUG: kernel NULL pointer dereference, address: 000000000000004c
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 0 P4D 0
Oops: 0000 [#1] PREEMPT SMP NOPTI
CPU: 0 PID: 407 Comm: a.out Not tainted 6.4.12-arch1-1 #1 3e6fa2753a2d75925c34ecb78e22e85a65d083df
Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 05/28/2020
RIP: 0010:aa_label_next_confined+0xb/0x40
Code: 00 00 48 89 ef e8 d5 25 0c 00 e9 66 ff ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 66 0f 1f 00 0f 1f 44 00 00 89 f0 &lt;8b&gt; 77 4c 39 c6 7e 1f 48 63 d0 48 8d 14 d7 eb 0b 83 c0 01 48 83 c2
RSP: 0018:ffffa92940003b08 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 000000000000000e
RDX: ffffa92940003be8 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffff8b57471e7800 R08: ffff8b574c642400 R09: 0000000000000002
R10: ffffffffbd820eeb R11: ffffffffbeb7ff00 R12: ffff8b574c642400
R13: 0000000000000001 R14: 0000000000000001 R15: 0000000000000000
FS:  00007fb092ea7640(0000) GS:ffff8b577bc00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000000004c CR3: 00000001020f2005 CR4: 00000000007706f0
PKRU: 55555554
Call Trace:
 &lt;IRQ&gt;
 ? __die+0x23/0x70
 ? page_fault_oops+0x171/0x4e0
 ? exc_page_fault+0x7f/0x180
 ? asm_exc_page_fault+0x26/0x30
 ? aa_label_next_confined+0xb/0x40
 apparmor_secmark_check+0xec/0x330
 security_sock_rcv_skb+0x35/0x50
 sk_filter_trim_cap+0x47/0x250
 sock_queue_rcv_skb_reason+0x20/0x60
 raw_rcv+0x13c/0x210
 raw_local_deliver+0x1f3/0x250
 ip_protocol_deliver_rcu+0x4f/0x2f0
 ip_local_deliver_finish+0x76/0xa0
 __netif_receive_skb_one_core+0x89/0xa0
 netif_receive_skb+0x119/0x170
 ? __netdev_alloc_skb+0x3d/0x140
 vmxnet3_rq_rx_complete+0xb23/0x1010 [vmxnet3 56a84f9c97178c57a43a24ec073b45a9d6f01f3a]
 vmxnet3_poll_rx_only+0x36/0xb0 [vmxnet3 56a84f9c97178c57a43a24ec073b45a9d6f01f3a]
 __napi_poll+0x28/0x1b0
 net_rx_action+0x2a4/0x380
 __do_softirq+0xd1/0x2c8
 __irq_exit_rcu+0xbb/0xf0
 common_interrupt+0x86/0xa0
 &lt;/IRQ&gt;
 &lt;TASK&gt;
 asm_common_interrupt+0x26/0x40
RIP: 0010:apparmor_socket_post_create+0xb/0x200
Code: 08 48 85 ff 75 a1 eb b1 0f 1f 80 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 41 54 &lt;55&gt; 48 89 fd 53 45 85 c0 0f 84 b2 00 00 00 48 8b 1d 80 56 3f 02 48
RSP: 0018:ffffa92940ce7e50 EFLAGS: 00000286
RAX: ffffffffbc756440 RBX: 0000000000000000 RCX: 0000000000000001
RDX: 0000000000000003 RSI: 0000000000000002 RDI: ffff8b574eaab740
RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000
R10: ffff8b57444cec70 R11: 0000000000000000 R12: 0000000000000003
R13: 0000000000000002 R14: ffff8b574eaab740 R15: ffffffffbd8e4748
 ? __pfx_apparmor_socket_post_create+0x10/0x10
 security_socket_post_create+0x4b/0x80
 __sock_create+0x176/0x1f0
 __sys_socket+0x89/0x100
 __x64_sys_socket+0x17/0x20
 do_syscall_64+0x5d/0x90
 ? do_syscall_64+0x6c/0x90
 ? do_syscall_64+0x6c/0x90
 ? do_syscall_64+0x6c/0x90
 entry_SYSCALL_64_after_hwframe+0x72/0xdc

The Linux kernel CVE team has assigned CVE-2023-52889 to this issue.

openEuler评分:(评分和向量)
5.5
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

受影响版本排查(受影响/不受影响):
1.openEuler-20.03-LTS-SP4:不受影响
2.openEuler-22.03-LTS-SP1:不受影响
3.openEuler-22.03-LTS-SP3:不受影响
4.openEuler-22.03-LTS-SP4:不受影响
5.master(6.1.0):不受影响
6.openEuler-24.03-LTS:不受影响
7.openEuler-24.03-LTS-Next:不受影响

修复是否涉及abi变化(是/否)：
1.openEuler-20.03-LTS-SP4:否
2.openEuler-22.03-LTS-SP1:否
3.openEuler-22.03-LTS-SP3:否
4.master(6.1.0):否
5.openEuler-24.03-LTS:否
6.openEuler-24.03-LTS-Next:否
7.openEuler-22.03-LTS-SP4:否

@sanglipeng 经过 cve-manager 解析, 已分析的内容如下表所示:
| 状态  | 需分析 | 内容 |
|:--:|:--:|---------|
|已分析|1.影响性分析说明|In the Linux kernel, the following vulnerability has been resolved:apparmor: Fix null pointer deref when receiving skb during sock creationThe panic below is observed when receiving ICMP packets with secmark setwhile an ICMP raw socket is being created. SK_CTX(sk)-&gt;label is updatedin apparmor_socket_post_create(), but the packet is delivered to thesocket before that, causing the null pointer dereference.Drop the packet if label context is not set.    BUG: kernel NULL pointer dereference, address: 000000000000004c    #PF: supervisor read access in kernel mode    #PF: error_code(0x0000) - not-present page    PGD 0 P4D 0    Oops: 0000 [#1] PREEMPT SMP NOPTI    CPU: 0 PID: 407 Comm: a.out Not tainted 6.4.12-arch1-1 #1 3e6fa2753a2d75925c34ecb78e22e85a65d083df    Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 05/28/2020    RIP: 0010:aa_label_next_confined+0xb/0x40    Code: 00 00 48 89 ef e8 d5 25 0c 00 e9 66 ff ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 66 0f 1f 00 0f 1f 44 00 00 89 f0 &lt;8b&gt; 77 4c 39 c6 7e 1f 48 63 d0 48 8d 14 d7 eb 0b 83 c0 01 48 83 c2    RSP: 0018:ffffa92940003b08 EFLAGS: 00010246    RAX: 0000000000000000 RBX: 0000000000000000 RCX: 000000000000000e    RDX: ffffa92940003be8 RSI: 0000000000000000 RDI: 0000000000000000    RBP: ffff8b57471e7800 R08: ffff8b574c642400 R09: 0000000000000002    R10: ffffffffbd820eeb R11: ffffffffbeb7ff00 R12: ffff8b574c642400    R13: 0000000000000001 R14: 0000000000000001 R15: 0000000000000000    FS:  00007fb092ea7640(0000) GS:ffff8b577bc00000(0000) knlGS:0000000000000000    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033    CR2: 000000000000004c CR3: 00000001020f2005 CR4: 00000000007706f0    PKRU: 55555554    Call Trace:     &lt;IRQ&gt;     ? __die+0x23/0x70     ? page_fault_oops+0x171/0x4e0     ? exc_page_fault+0x7f/0x180     ? asm_exc_page_fault+0x26/0x30     ? aa_label_next_confined+0xb/0x40     apparmor_secmark_check+0xec/0x330     security_sock_rcv_skb+0x35/0x50     sk_filter_trim_cap+0x47/0x250     sock_queue_rcv_skb_reason+0x20/0x60     raw_rcv+0x13c/0x210     raw_local_deliver+0x1f3/0x250     ip_protocol_deliver_rcu+0x4f/0x2f0     ip_local_deliver_finish+0x76/0xa0     __netif_receive_skb_one_core+0x89/0xa0     netif_receive_skb+0x119/0x170     ? __netdev_alloc_skb+0x3d/0x140     vmxnet3_rq_rx_complete+0xb23/0x1010 [vmxnet3 56a84f9c97178c57a43a24ec073b45a9d6f01f3a]     vmxnet3_poll_rx_only+0x36/0xb0 [vmxnet3 56a84f9c97178c57a43a24ec073b45a9d6f01f3a]     __napi_poll+0x28/0x1b0     net_rx_action+0x2a4/0x380     __do_softirq+0xd1/0x2c8     __irq_exit_rcu+0xbb/0xf0     common_interrupt+0x86/0xa0     &lt;/IRQ&gt;     &lt;TASK&gt;     asm_common_interrupt+0x26/0x40    RIP: 0010:apparmor_socket_post_create+0xb/0x200    Code: 08 48 85 ff 75 a1 eb b1 0f 1f 80 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 41 54 &lt;55&gt; 48 89 fd 53 45 85 c0 0f 84 b2 00 00 00 48 8b 1d 80 56 3f 02 48    RSP: 0018:ffffa92940ce7e50 EFLAGS: 00000286    RAX: ffffffffbc756440 RBX: 0000000000000000 RCX: 0000000000000001    RDX: 0000000000000003 RSI: 0000000000000002 RDI: ffff8b574eaab740    RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000    R10: ffff8b57444cec70 R11: 0000000000000000 R12: 0000000000000003    R13: 0000000000000002 R14: ffff8b574eaab740 R15: ffffffffbd8e4748     ? __pfx_apparmor_socket_post_create+0x10/0x10     security_socket_post_create+0x4b/0x80     __sock_create+0x176/0x1f0     __sys_socket+0x89/0x100     __x64_sys_socket+0x17/0x20     do_syscall_64+0x5d/0x90     ? do_syscall_64+0x6c/0x90     ? do_syscall_64+0x6c/0x90     ? do_syscall_64+0x6c/0x90     entry_SYSCALL_64_after_hwframe+0x72/0xdcThe Linux kernel CVE team has assigned CVE-2023-52889 to this issue.|
|已分析|2.openEulerScore|5.5|
|已分析|3.openEulerVector|AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H|
|已分析|4.受影响版本排查|openEuler-20.03-LTS-SP4:不受影响,openEuler-22.03-LTS-SP1:不受影响,openEuler-22.03-LTS-SP3:不受影响,openEuler-22.03-LTS-SP4:不受影响,master:不受影响,openEuler-24.03-LTS:不受影响,openEuler-24.03-LTS-Next:不受影响|
|已分析|5.修复是否涉及abi变化|openEuler-20.03-LTS-SP4:否,openEuler-22.03-LTS-SP1:否,openEuler-22.03-LTS-SP3:否,master:否,openEuler-24.03-LTS:否,openEuler-24.03-LTS-Next:否,openEuler-22.03-LTS-SP4:否|

**请确认分析内容的准确性, 确认无误后, 您可以进行后续步骤, 否则您可以继续分析.**

CVE-2023-52889

影响性分析说明：
In the Linux kernel, the following vulnerability has been resolved:

apparmor: Fix null pointer deref when receiving skb during sock creation

The panic below is observed when receiving ICMP packets with secmark set
while an ICMP raw socket is being created. SK_CTX(sk)->label is updated
in apparmor_socket_post_create(), but the packet is delivered to the
socket before that, causing the null pointer dereference.
Drop the packet if label context is not set.

BUG: kernel NULL pointer dereference, address: 000000000000004c
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 0 P4D 0
Oops: 0000 [#1] PREEMPT SMP NOPTI
CPU: 0 PID: 407 Comm: a.out Not tainted 6.4.12-arch1-1 #1 3e6fa2753a2d75925c34ecb78e22e85a65d083df
Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 05/28/2020
RIP: 0010:aa_label_next_confined+0xb/0x40
Code: 00 00 48 89 ef e8 d5 25 0c 00 e9 66 ff ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 66 0f 1f 00 0f 1f 44 00 00 89 f0 &lt;8b&gt; 77 4c 39 c6 7e 1f 48 63 d0 48 8d 14 d7 eb 0b 83 c0 01 48 83 c2
RSP: 0018:ffffa92940003b08 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 000000000000000e
RDX: ffffa92940003be8 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffff8b57471e7800 R08: ffff8b574c642400 R09: 0000000000000002
R10: ffffffffbd820eeb R11: ffffffffbeb7ff00 R12: ffff8b574c642400
R13: 0000000000000001 R14: 0000000000000001 R15: 0000000000000000
FS:  00007fb092ea7640(0000) GS:ffff8b577bc00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000000004c CR3: 00000001020f2005 CR4: 00000000007706f0
PKRU: 55555554
Call Trace:
 &lt;IRQ&gt;
 ? __die+0x23/0x70
 ? page_fault_oops+0x171/0x4e0
 ? exc_page_fault+0x7f/0x180
 ? asm_exc_page_fault+0x26/0x30
 ? aa_label_next_confined+0xb/0x40
 apparmor_secmark_check+0xec/0x330
 security_sock_rcv_skb+0x35/0x50
 sk_filter_trim_cap+0x47/0x250
 sock_queue_rcv_skb_reason+0x20/0x60
 raw_rcv+0x13c/0x210
 raw_local_deliver+0x1f3/0x250
 ip_protocol_deliver_rcu+0x4f/0x2f0
 ip_local_deliver_finish+0x76/0xa0
 __netif_receive_skb_one_core+0x89/0xa0
 netif_receive_skb+0x119/0x170
 ? __netdev_alloc_skb+0x3d/0x140
 vmxnet3_rq_rx_complete+0xb23/0x1010 [vmxnet3 56a84f9c97178c57a43a24ec073b45a9d6f01f3a]
 vmxnet3_poll_rx_only+0x36/0xb0 [vmxnet3 56a84f9c97178c57a43a24ec073b45a9d6f01f3a]
 __napi_poll+0x28/0x1b0
 net_rx_action+0x2a4/0x380
 __do_softirq+0xd1/0x2c8
 __irq_exit_rcu+0xbb/0xf0
 common_interrupt+0x86/0xa0
 &lt;/IRQ&gt;
 &lt;TASK&gt;
 asm_common_interrupt+0x26/0x40
RIP: 0010:apparmor_socket_post_create+0xb/0x200
Code: 08 48 85 ff 75 a1 eb b1 0f 1f 80 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 41 54 &lt;55&gt; 48 89 fd 53 45 85 c0 0f 84 b2 00 00 00 48 8b 1d 80 56 3f 02 48
RSP: 0018:ffffa92940ce7e50 EFLAGS: 00000286
RAX: ffffffffbc756440 RBX: 0000000000000000 RCX: 0000000000000001
RDX: 0000000000000003 RSI: 0000000000000002 RDI: ffff8b574eaab740
RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000
R10: ffff8b57444cec70 R11: 0000000000000000 R12: 0000000000000003
R13: 0000000000000002 R14: ffff8b574eaab740 R15: ffffffffbd8e4748
 ? __pfx_apparmor_socket_post_create+0x10/0x10
 security_socket_post_create+0x4b/0x80
 __sock_create+0x176/0x1f0
 __sys_socket+0x89/0x100
 __x64_sys_socket+0x17/0x20
 do_syscall_64+0x5d/0x90
 ? do_syscall_64+0x6c/0x90
 ? do_syscall_64+0x6c/0x90
 ? do_syscall_64+0x6c/0x90
 entry_SYSCALL_64_after_hwframe+0x72/0xdc

The Linux kernel CVE team has assigned CVE-2023-52889 to this issue.

openEuler评分:(评分和向量)
5.5
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

受影响版本排查(受影响/不受影响):
1.openEuler-20.03-LTS-SP4:不受影响
2.openEuler-22.03-LTS-SP1:受影响
3.openEuler-22.03-LTS-SP3:受影响
4.openEuler-22.03-LTS-SP4:受影响
5.master(6.1.0):不受影响
6.openEuler-24.03-LTS:受影响
7.openEuler-24.03-LTS-Next:不受影响

修复是否涉及abi变化(是/否)：
1.openEuler-20.03-LTS-SP4:否
2.openEuler-22.03-LTS-SP1:否
3.openEuler-22.03-LTS-SP3:否
4.master(6.1.0):否
5.openEuler-24.03-LTS:否
6.openEuler-24.03-LTS-Next:否
7.openEuler-22.03-LTS-SP4:否

@sanglipeng 经过 cve-manager 解析, 已分析的内容如下表所示:
| 状态  | 需分析 | 内容 |
|:--:|:--:|---------|
|已分析|1.影响性分析说明|In the Linux kernel, the following vulnerability has been resolved:apparmor: Fix null pointer deref when receiving skb during sock creationThe panic below is observed when receiving ICMP packets with secmark setwhile an ICMP raw socket is being created. SK_CTX(sk)-&gt;label is updatedin apparmor_socket_post_create(), but the packet is delivered to thesocket before that, causing the null pointer dereference.Drop the packet if label context is not set.    BUG: kernel NULL pointer dereference, address: 000000000000004c    #PF: supervisor read access in kernel mode    #PF: error_code(0x0000) - not-present page    PGD 0 P4D 0    Oops: 0000 [#1] PREEMPT SMP NOPTI    CPU: 0 PID: 407 Comm: a.out Not tainted 6.4.12-arch1-1 #1 3e6fa2753a2d75925c34ecb78e22e85a65d083df    Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 05/28/2020    RIP: 0010:aa_label_next_confined+0xb/0x40    Code: 00 00 48 89 ef e8 d5 25 0c 00 e9 66 ff ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 66 0f 1f 00 0f 1f 44 00 00 89 f0 &lt;8b&gt; 77 4c 39 c6 7e 1f 48 63 d0 48 8d 14 d7 eb 0b 83 c0 01 48 83 c2    RSP: 0018:ffffa92940003b08 EFLAGS: 00010246    RAX: 0000000000000000 RBX: 0000000000000000 RCX: 000000000000000e    RDX: ffffa92940003be8 RSI: 0000000000000000 RDI: 0000000000000000    RBP: ffff8b57471e7800 R08: ffff8b574c642400 R09: 0000000000000002    R10: ffffffffbd820eeb R11: ffffffffbeb7ff00 R12: ffff8b574c642400    R13: 0000000000000001 R14: 0000000000000001 R15: 0000000000000000    FS:  00007fb092ea7640(0000) GS:ffff8b577bc00000(0000) knlGS:0000000000000000    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033    CR2: 000000000000004c CR3: 00000001020f2005 CR4: 00000000007706f0    PKRU: 55555554    Call Trace:     &lt;IRQ&gt;     ? __die+0x23/0x70     ? page_fault_oops+0x171/0x4e0     ? exc_page_fault+0x7f/0x180     ? asm_exc_page_fault+0x26/0x30     ? aa_label_next_confined+0xb/0x40     apparmor_secmark_check+0xec/0x330     security_sock_rcv_skb+0x35/0x50     sk_filter_trim_cap+0x47/0x250     sock_queue_rcv_skb_reason+0x20/0x60     raw_rcv+0x13c/0x210     raw_local_deliver+0x1f3/0x250     ip_protocol_deliver_rcu+0x4f/0x2f0     ip_local_deliver_finish+0x76/0xa0     __netif_receive_skb_one_core+0x89/0xa0     netif_receive_skb+0x119/0x170     ? __netdev_alloc_skb+0x3d/0x140     vmxnet3_rq_rx_complete+0xb23/0x1010 [vmxnet3 56a84f9c97178c57a43a24ec073b45a9d6f01f3a]     vmxnet3_poll_rx_only+0x36/0xb0 [vmxnet3 56a84f9c97178c57a43a24ec073b45a9d6f01f3a]     __napi_poll+0x28/0x1b0     net_rx_action+0x2a4/0x380     __do_softirq+0xd1/0x2c8     __irq_exit_rcu+0xbb/0xf0     common_interrupt+0x86/0xa0     &lt;/IRQ&gt;     &lt;TASK&gt;     asm_common_interrupt+0x26/0x40    RIP: 0010:apparmor_socket_post_create+0xb/0x200    Code: 08 48 85 ff 75 a1 eb b1 0f 1f 80 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 41 54 &lt;55&gt; 48 89 fd 53 45 85 c0 0f 84 b2 00 00 00 48 8b 1d 80 56 3f 02 48    RSP: 0018:ffffa92940ce7e50 EFLAGS: 00000286    RAX: ffffffffbc756440 RBX: 0000000000000000 RCX: 0000000000000001    RDX: 0000000000000003 RSI: 0000000000000002 RDI: ffff8b574eaab740    RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000    R10: ffff8b57444cec70 R11: 0000000000000000 R12: 0000000000000003    R13: 0000000000000002 R14: ffff8b574eaab740 R15: ffffffffbd8e4748     ? __pfx_apparmor_socket_post_create+0x10/0x10     security_socket_post_create+0x4b/0x80     __sock_create+0x176/0x1f0     __sys_socket+0x89/0x100     __x64_sys_socket+0x17/0x20     do_syscall_64+0x5d/0x90     ? do_syscall_64+0x6c/0x90     ? do_syscall_64+0x6c/0x90     ? do_syscall_64+0x6c/0x90     entry_SYSCALL_64_after_hwframe+0x72/0xdcThe Linux kernel CVE team has assigned CVE-2023-52889 to this issue.|
|已分析|2.openEulerScore|5.5|
|已分析|3.openEulerVector|AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H|
|已分析|4.受影响版本排查|openEuler-22.03-LTS-SP1:受影响,openEuler-22.03-LTS-SP3:受影响,openEuler-22.03-LTS-SP4:受影响,openEuler-24.03-LTS:受影响,openEuler-20.03-LTS-SP4:不受影响,master:不受影响,openEuler-24.03-LTS-Next:不受影响|
|已分析|5.修复是否涉及abi变化|openEuler-20.03-LTS-SP4:否,openEuler-22.03-LTS-SP1:否,openEuler-22.03-LTS-SP3:否,master:否,openEuler-24.03-LTS:否,openEuler-24.03-LTS-Next:否,openEuler-22.03-LTS-SP4:否|

**请确认分析内容的准确性, 确认无误后, 您可以进行后续步骤, 否则您可以继续分析.**

CVE-2023-52889

影响性分析说明：
In the Linux kernel, the following vulnerability has been resolved:

apparmor: Fix null pointer deref when receiving skb during sock creation

The panic below is observed when receiving ICMP packets with secmark set
while an ICMP raw socket is being created. SK_CTX(sk)->label is updated
in apparmor_socket_post_create(), but the packet is delivered to the
socket before that, causing the null pointer dereference.
Drop the packet if label context is not set.

BUG: kernel NULL pointer dereference, address: 000000000000004c
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 0 P4D 0
Oops: 0000 [#1] PREEMPT SMP NOPTI
CPU: 0 PID: 407 Comm: a.out Not tainted 6.4.12-arch1-1 #1 3e6fa2753a2d75925c34ecb78e22e85a65d083df
Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 05/28/2020
RIP: 0010:aa_label_next_confined+0xb/0x40
Code: 00 00 48 89 ef e8 d5 25 0c 00 e9 66 ff ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 66 0f 1f 00 0f 1f 44 00 00 89 f0 &lt;8b&gt; 77 4c 39 c6 7e 1f 48 63 d0 48 8d 14 d7 eb 0b 83 c0 01 48 83 c2
RSP: 0018:ffffa92940003b08 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 000000000000000e
RDX: ffffa92940003be8 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffff8b57471e7800 R08: ffff8b574c642400 R09: 0000000000000002
R10: ffffffffbd820eeb R11: ffffffffbeb7ff00 R12: ffff8b574c642400
R13: 0000000000000001 R14: 0000000000000001 R15: 0000000000000000
FS:  00007fb092ea7640(0000) GS:ffff8b577bc00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000000004c CR3: 00000001020f2005 CR4: 00000000007706f0
PKRU: 55555554
Call Trace:
 &lt;IRQ&gt;
 ? __die+0x23/0x70
 ? page_fault_oops+0x171/0x4e0
 ? exc_page_fault+0x7f/0x180
 ? asm_exc_page_fault+0x26/0x30
 ? aa_label_next_confined+0xb/0x40
 apparmor_secmark_check+0xec/0x330
 security_sock_rcv_skb+0x35/0x50
 sk_filter_trim_cap+0x47/0x250
 sock_queue_rcv_skb_reason+0x20/0x60
 raw_rcv+0x13c/0x210
 raw_local_deliver+0x1f3/0x250
 ip_protocol_deliver_rcu+0x4f/0x2f0
 ip_local_deliver_finish+0x76/0xa0
 __netif_receive_skb_one_core+0x89/0xa0
 netif_receive_skb+0x119/0x170
 ? __netdev_alloc_skb+0x3d/0x140
 vmxnet3_rq_rx_complete+0xb23/0x1010 [vmxnet3 56a84f9c97178c57a43a24ec073b45a9d6f01f3a]
 vmxnet3_poll_rx_only+0x36/0xb0 [vmxnet3 56a84f9c97178c57a43a24ec073b45a9d6f01f3a]
 __napi_poll+0x28/0x1b0
 net_rx_action+0x2a4/0x380
 __do_softirq+0xd1/0x2c8
 __irq_exit_rcu+0xbb/0xf0
 common_interrupt+0x86/0xa0
 &lt;/IRQ&gt;
 &lt;TASK&gt;
 asm_common_interrupt+0x26/0x40
RIP: 0010:apparmor_socket_post_create+0xb/0x200
Code: 08 48 85 ff 75 a1 eb b1 0f 1f 80 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 41 54 &lt;55&gt; 48 89 fd 53 45 85 c0 0f 84 b2 00 00 00 48 8b 1d 80 56 3f 02 48
RSP: 0018:ffffa92940ce7e50 EFLAGS: 00000286
RAX: ffffffffbc756440 RBX: 0000000000000000 RCX: 0000000000000001
RDX: 0000000000000003 RSI: 0000000000000002 RDI: ffff8b574eaab740
RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000
R10: ffff8b57444cec70 R11: 0000000000000000 R12: 0000000000000003
R13: 0000000000000002 R14: ffff8b574eaab740 R15: ffffffffbd8e4748
 ? __pfx_apparmor_socket_post_create+0x10/0x10
 security_socket_post_create+0x4b/0x80
 __sock_create+0x176/0x1f0
 __sys_socket+0x89/0x100
 __x64_sys_socket+0x17/0x20
 do_syscall_64+0x5d/0x90
 ? do_syscall_64+0x6c/0x90
 ? do_syscall_64+0x6c/0x90
 ? do_syscall_64+0x6c/0x90
 entry_SYSCALL_64_after_hwframe+0x72/0xdc

The Linux kernel CVE team has assigned CVE-2023-52889 to this issue.

openEuler评分:(评分和向量)
5.5
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

受影响版本排查(受影响/不受影响):
1.openEuler-20.03-LTS-SP4:不受影响
2.openEuler-22.03-LTS-SP1:受影响
3.openEuler-22.03-LTS-SP3:受影响
4.openEuler-22.03-LTS-SP4:受影响
5.master(6.1.0):不受影响
6.openEuler-24.03-LTS:受影响
7.openEuler-24.03-LTS-Next:不受影响

修复是否涉及abi变化(是/否)：
1.openEuler-20.03-LTS-SP4:否
2.openEuler-22.03-LTS-SP1:否
3.openEuler-22.03-LTS-SP3:否
4.master(6.1.0):否
5.openEuler-24.03-LTS:否
6.openEuler-24.03-LTS-Next:否
7.openEuler-22.03-LTS-SP4:否

@sanglipeng 经过 cve-manager 解析, 已分析的内容如下表所示:
| 状态  | 需分析 | 内容 |
|:--:|:--:|---------|
|已分析|1.影响性分析说明|In the Linux kernel, the following vulnerability has been resolved:apparmor: Fix null pointer deref when receiving skb during sock creationThe panic below is observed when receiving ICMP packets with secmark setwhile an ICMP raw socket is being created. SK_CTX(sk)-&gt;label is updatedin apparmor_socket_post_create(), but the packet is delivered to thesocket before that, causing the null pointer dereference.Drop the packet if label context is not set.    BUG: kernel NULL pointer dereference, address: 000000000000004c    #PF: supervisor read access in kernel mode    #PF: error_code(0x0000) - not-present page    PGD 0 P4D 0    Oops: 0000 [#1] PREEMPT SMP NOPTI    CPU: 0 PID: 407 Comm: a.out Not tainted 6.4.12-arch1-1 #1 3e6fa2753a2d75925c34ecb78e22e85a65d083df    Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 05/28/2020    RIP: 0010:aa_label_next_confined+0xb/0x40    Code: 00 00 48 89 ef e8 d5 25 0c 00 e9 66 ff ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 66 0f 1f 00 0f 1f 44 00 00 89 f0 &lt;8b&gt; 77 4c 39 c6 7e 1f 48 63 d0 48 8d 14 d7 eb 0b 83 c0 01 48 83 c2    RSP: 0018:ffffa92940003b08 EFLAGS: 00010246    RAX: 0000000000000000 RBX: 0000000000000000 RCX: 000000000000000e    RDX: ffffa92940003be8 RSI: 0000000000000000 RDI: 0000000000000000    RBP: ffff8b57471e7800 R08: ffff8b574c642400 R09: 0000000000000002    R10: ffffffffbd820eeb R11: ffffffffbeb7ff00 R12: ffff8b574c642400    R13: 0000000000000001 R14: 0000000000000001 R15: 0000000000000000    FS:  00007fb092ea7640(0000) GS:ffff8b577bc00000(0000) knlGS:0000000000000000    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033    CR2: 000000000000004c CR3: 00000001020f2005 CR4: 00000000007706f0    PKRU: 55555554    Call Trace:     &lt;IRQ&gt;     ? __die+0x23/0x70     ? page_fault_oops+0x171/0x4e0     ? exc_page_fault+0x7f/0x180     ? asm_exc_page_fault+0x26/0x30     ? aa_label_next_confined+0xb/0x40     apparmor_secmark_check+0xec/0x330     security_sock_rcv_skb+0x35/0x50     sk_filter_trim_cap+0x47/0x250     sock_queue_rcv_skb_reason+0x20/0x60     raw_rcv+0x13c/0x210     raw_local_deliver+0x1f3/0x250     ip_protocol_deliver_rcu+0x4f/0x2f0     ip_local_deliver_finish+0x76/0xa0     __netif_receive_skb_one_core+0x89/0xa0     netif_receive_skb+0x119/0x170     ? __netdev_alloc_skb+0x3d/0x140     vmxnet3_rq_rx_complete+0xb23/0x1010 [vmxnet3 56a84f9c97178c57a43a24ec073b45a9d6f01f3a]     vmxnet3_poll_rx_only+0x36/0xb0 [vmxnet3 56a84f9c97178c57a43a24ec073b45a9d6f01f3a]     __napi_poll+0x28/0x1b0     net_rx_action+0x2a4/0x380     __do_softirq+0xd1/0x2c8     __irq_exit_rcu+0xbb/0xf0     common_interrupt+0x86/0xa0     &lt;/IRQ&gt;     &lt;TASK&gt;     asm_common_interrupt+0x26/0x40    RIP: 0010:apparmor_socket_post_create+0xb/0x200    Code: 08 48 85 ff 75 a1 eb b1 0f 1f 80 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 41 54 &lt;55&gt; 48 89 fd 53 45 85 c0 0f 84 b2 00 00 00 48 8b 1d 80 56 3f 02 48    RSP: 0018:ffffa92940ce7e50 EFLAGS: 00000286    RAX: ffffffffbc756440 RBX: 0000000000000000 RCX: 0000000000000001    RDX: 0000000000000003 RSI: 0000000000000002 RDI: ffff8b574eaab740    RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000    R10: ffff8b57444cec70 R11: 0000000000000000 R12: 0000000000000003    R13: 0000000000000002 R14: ffff8b574eaab740 R15: ffffffffbd8e4748     ? __pfx_apparmor_socket_post_create+0x10/0x10     security_socket_post_create+0x4b/0x80     __sock_create+0x176/0x1f0     __sys_socket+0x89/0x100     __x64_sys_socket+0x17/0x20     do_syscall_64+0x5d/0x90     ? do_syscall_64+0x6c/0x90     ? do_syscall_64+0x6c/0x90     ? do_syscall_64+0x6c/0x90     entry_SYSCALL_64_after_hwframe+0x72/0xdcThe Linux kernel CVE team has assigned CVE-2023-52889 to this issue.|
|已分析|2.openEulerScore|5.5|
|已分析|3.openEulerVector|AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H|
|已分析|4.受影响版本排查|openEuler-22.03-LTS-SP1:受影响,openEuler-22.03-LTS-SP3:受影响,openEuler-22.03-LTS-SP4:受影响,openEuler-24.03-LTS:受影响,openEuler-20.03-LTS-SP4:不受影响,master:不受影响,openEuler-24.03-LTS-Next:不受影响|
|已分析|5.修复是否涉及abi变化|openEuler-20.03-LTS-SP4:否,openEuler-22.03-LTS-SP1:否,openEuler-22.03-LTS-SP3:否,master:否,openEuler-24.03-LTS:否,openEuler-24.03-LTS-Next:否,openEuler-22.03-LTS-SP4:否|

**请确认分析内容的准确性, 确认无误后, 您可以进行后续步骤, 否则您可以继续分析.**

CVE-2023-52889

影响性分析说明：
In the Linux kernel, the following vulnerability has been resolved:

apparmor: Fix null pointer deref when receiving skb during sock creation

The panic below is observed when receiving ICMP packets with secmark set
while an ICMP raw socket is being created. SK_CTX(sk)->label is updated
in apparmor_socket_post_create(), but the packet is delivered to the
socket before that, causing the null pointer dereference.
Drop the packet if label context is not set.

BUG: kernel NULL pointer dereference, address: 000000000000004c
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 0 P4D 0
Oops: 0000 [#1] PREEMPT SMP NOPTI
CPU: 0 PID: 407 Comm: a.out Not tainted 6.4.12-arch1-1 #1 3e6fa2753a2d75925c34ecb78e22e85a65d083df
Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 05/28/2020
RIP: 0010:aa_label_next_confined+0xb/0x40
Code: 00 00 48 89 ef e8 d5 25 0c 00 e9 66 ff ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 66 0f 1f 00 0f 1f 44 00 00 89 f0 &lt;8b&gt; 77 4c 39 c6 7e 1f 48 63 d0 48 8d 14 d7 eb 0b 83 c0 01 48 83 c2
RSP: 0018:ffffa92940003b08 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 000000000000000e
RDX: ffffa92940003be8 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffff8b57471e7800 R08: ffff8b574c642400 R09: 0000000000000002
R10: ffffffffbd820eeb R11: ffffffffbeb7ff00 R12: ffff8b574c642400
R13: 0000000000000001 R14: 0000000000000001 R15: 0000000000000000
FS:  00007fb092ea7640(0000) GS:ffff8b577bc00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000000004c CR3: 00000001020f2005 CR4: 00000000007706f0
PKRU: 55555554
Call Trace:
 &lt;IRQ&gt;
 ? __die+0x23/0x70
 ? page_fault_oops+0x171/0x4e0
 ? exc_page_fault+0x7f/0x180
 ? asm_exc_page_fault+0x26/0x30
 ? aa_label_next_confined+0xb/0x40
 apparmor_secmark_check+0xec/0x330
 security_sock_rcv_skb+0x35/0x50
 sk_filter_trim_cap+0x47/0x250
 sock_queue_rcv_skb_reason+0x20/0x60
 raw_rcv+0x13c/0x210
 raw_local_deliver+0x1f3/0x250
 ip_protocol_deliver_rcu+0x4f/0x2f0
 ip_local_deliver_finish+0x76/0xa0
 __netif_receive_skb_one_core+0x89/0xa0
 netif_receive_skb+0x119/0x170
 ? __netdev_alloc_skb+0x3d/0x140
 vmxnet3_rq_rx_complete+0xb23/0x1010 [vmxnet3 56a84f9c97178c57a43a24ec073b45a9d6f01f3a]
 vmxnet3_poll_rx_only+0x36/0xb0 [vmxnet3 56a84f9c97178c57a43a24ec073b45a9d6f01f3a]
 __napi_poll+0x28/0x1b0
 net_rx_action+0x2a4/0x380
 __do_softirq+0xd1/0x2c8
 __irq_exit_rcu+0xbb/0xf0
 common_interrupt+0x86/0xa0
 &lt;/IRQ&gt;
 &lt;TASK&gt;
 asm_common_interrupt+0x26/0x40
RIP: 0010:apparmor_socket_post_create+0xb/0x200
Code: 08 48 85 ff 75 a1 eb b1 0f 1f 80 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 41 54 &lt;55&gt; 48 89 fd 53 45 85 c0 0f 84 b2 00 00 00 48 8b 1d 80 56 3f 02 48
RSP: 0018:ffffa92940ce7e50 EFLAGS: 00000286
RAX: ffffffffbc756440 RBX: 0000000000000000 RCX: 0000000000000001
RDX: 0000000000000003 RSI: 0000000000000002 RDI: ffff8b574eaab740
RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000
R10: ffff8b57444cec70 R11: 0000000000000000 R12: 0000000000000003
R13: 0000000000000002 R14: ffff8b574eaab740 R15: ffffffffbd8e4748
 ? __pfx_apparmor_socket_post_create+0x10/0x10
 security_socket_post_create+0x4b/0x80
 __sock_create+0x176/0x1f0
 __sys_socket+0x89/0x100
 __x64_sys_socket+0x17/0x20
 do_syscall_64+0x5d/0x90
 ? do_syscall_64+0x6c/0x90
 ? do_syscall_64+0x6c/0x90
 ? do_syscall_64+0x6c/0x90
 entry_SYSCALL_64_after_hwframe+0x72/0xdc

The Linux kernel CVE team has assigned CVE-2023-52889 to this issue.

openEuler评分:(评分和向量)
5.5
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

受影响版本排查(受影响/不受影响):
1.openEuler-20.03-LTS-SP4:不受影响
2.openEuler-22.03-LTS-SP1:受影响
3.openEuler-22.03-LTS-SP3:受影响
4.openEuler-22.03-LTS-SP4:受影响
5.master(6.1.0):不受影响
6.openEuler-24.03-LTS:受影响
7.openEuler-24.03-LTS-Next:不受影响

修复是否涉及abi变化(是/否)：
1.openEuler-20.03-LTS-SP4:否
2.openEuler-22.03-LTS-SP1:否
3.openEuler-22.03-LTS-SP3:否
4.master(6.1.0):否
5.openEuler-24.03-LTS:否
6.openEuler-24.03-LTS-Next:否
7.openEuler-22.03-LTS-SP4:否

@sanglipeng 经过 cve-manager 解析, 已分析的内容如下表所示:
| 状态  | 需分析 | 内容 |
|:--:|:--:|---------|
|已分析|1.影响性分析说明|In the Linux kernel, the following vulnerability has been resolved:apparmor: Fix null pointer deref when receiving skb during sock creationThe panic below is observed when receiving ICMP packets with secmark setwhile an ICMP raw socket is being created. SK_CTX(sk)-&gt;label is updatedin apparmor_socket_post_create(), but the packet is delivered to thesocket before that, causing the null pointer dereference.Drop the packet if label context is not set.    BUG: kernel NULL pointer dereference, address: 000000000000004c    #PF: supervisor read access in kernel mode    #PF: error_code(0x0000) - not-present page    PGD 0 P4D 0    Oops: 0000 [#1] PREEMPT SMP NOPTI    CPU: 0 PID: 407 Comm: a.out Not tainted 6.4.12-arch1-1 #1 3e6fa2753a2d75925c34ecb78e22e85a65d083df    Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 05/28/2020    RIP: 0010:aa_label_next_confined+0xb/0x40    Code: 00 00 48 89 ef e8 d5 25 0c 00 e9 66 ff ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 66 0f 1f 00 0f 1f 44 00 00 89 f0 &lt;8b&gt; 77 4c 39 c6 7e 1f 48 63 d0 48 8d 14 d7 eb 0b 83 c0 01 48 83 c2    RSP: 0018:ffffa92940003b08 EFLAGS: 00010246    RAX: 0000000000000000 RBX: 0000000000000000 RCX: 000000000000000e    RDX: ffffa92940003be8 RSI: 0000000000000000 RDI: 0000000000000000    RBP: ffff8b57471e7800 R08: ffff8b574c642400 R09: 0000000000000002    R10: ffffffffbd820eeb R11: ffffffffbeb7ff00 R12: ffff8b574c642400    R13: 0000000000000001 R14: 0000000000000001 R15: 0000000000000000    FS:  00007fb092ea7640(0000) GS:ffff8b577bc00000(0000) knlGS:0000000000000000    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033    CR2: 000000000000004c CR3: 00000001020f2005 CR4: 00000000007706f0    PKRU: 55555554    Call Trace:     &lt;IRQ&gt;     ? __die+0x23/0x70     ? page_fault_oops+0x171/0x4e0     ? exc_page_fault+0x7f/0x180     ? asm_exc_page_fault+0x26/0x30     ? aa_label_next_confined+0xb/0x40     apparmor_secmark_check+0xec/0x330     security_sock_rcv_skb+0x35/0x50     sk_filter_trim_cap+0x47/0x250     sock_queue_rcv_skb_reason+0x20/0x60     raw_rcv+0x13c/0x210     raw_local_deliver+0x1f3/0x250     ip_protocol_deliver_rcu+0x4f/0x2f0     ip_local_deliver_finish+0x76/0xa0     __netif_receive_skb_one_core+0x89/0xa0     netif_receive_skb+0x119/0x170     ? __netdev_alloc_skb+0x3d/0x140     vmxnet3_rq_rx_complete+0xb23/0x1010 [vmxnet3 56a84f9c97178c57a43a24ec073b45a9d6f01f3a]     vmxnet3_poll_rx_only+0x36/0xb0 [vmxnet3 56a84f9c97178c57a43a24ec073b45a9d6f01f3a]     __napi_poll+0x28/0x1b0     net_rx_action+0x2a4/0x380     __do_softirq+0xd1/0x2c8     __irq_exit_rcu+0xbb/0xf0     common_interrupt+0x86/0xa0     &lt;/IRQ&gt;     &lt;TASK&gt;     asm_common_interrupt+0x26/0x40    RIP: 0010:apparmor_socket_post_create+0xb/0x200    Code: 08 48 85 ff 75 a1 eb b1 0f 1f 80 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 41 54 &lt;55&gt; 48 89 fd 53 45 85 c0 0f 84 b2 00 00 00 48 8b 1d 80 56 3f 02 48    RSP: 0018:ffffa92940ce7e50 EFLAGS: 00000286    RAX: ffffffffbc756440 RBX: 0000000000000000 RCX: 0000000000000001    RDX: 0000000000000003 RSI: 0000000000000002 RDI: ffff8b574eaab740    RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000    R10: ffff8b57444cec70 R11: 0000000000000000 R12: 0000000000000003    R13: 0000000000000002 R14: ffff8b574eaab740 R15: ffffffffbd8e4748     ? __pfx_apparmor_socket_post_create+0x10/0x10     security_socket_post_create+0x4b/0x80     __sock_create+0x176/0x1f0     __sys_socket+0x89/0x100     __x64_sys_socket+0x17/0x20     do_syscall_64+0x5d/0x90     ? do_syscall_64+0x6c/0x90     ? do_syscall_64+0x6c/0x90     ? do_syscall_64+0x6c/0x90     entry_SYSCALL_64_after_hwframe+0x72/0xdcThe Linux kernel CVE team has assigned CVE-2023-52889 to this issue.|
|已分析|2.openEulerScore|5.5|
|已分析|3.openEulerVector|AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H|
|已分析|4.受影响版本排查|openEuler-22.03-LTS-SP1:受影响,openEuler-22.03-LTS-SP3:受影响,openEuler-22.03-LTS-SP4:受影响,openEuler-24.03-LTS:受影响,openEuler-20.03-LTS-SP4:不受影响,master:不受影响,openEuler-24.03-LTS-Next:不受影响|
|已分析|5.修复是否涉及abi变化|openEuler-20.03-LTS-SP4:否,openEuler-22.03-LTS-SP1:否,openEuler-22.03-LTS-SP3:否,master:否,openEuler-24.03-LTS:否,openEuler-24.03-LTS-Next:否,openEuler-22.03-LTS-SP4:否|

**请确认分析内容的准确性, 确认无误后, 您可以进行后续步骤, 否则您可以继续分析.**

CVE-2023-52889

影响性分析说明：
In the Linux kernel, the following vulnerability has been resolved:

apparmor: Fix null pointer deref when receiving skb during sock creation

The panic below is observed when receiving ICMP packets with secmark set
while an ICMP raw socket is being created. SK_CTX(sk)->label is updated
in apparmor_socket_post_create(), but the packet is delivered to the
socket before that, causing the null pointer dereference.
Drop the packet if label context is not set.

BUG: kernel NULL pointer dereference, address: 000000000000004c
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 0 P4D 0
Oops: 0000 [#1] PREEMPT SMP NOPTI
CPU: 0 PID: 407 Comm: a.out Not tainted 6.4.12-arch1-1 #1 3e6fa2753a2d75925c34ecb78e22e85a65d083df
Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 05/28/2020
RIP: 0010:aa_label_next_confined+0xb/0x40
Code: 00 00 48 89 ef e8 d5 25 0c 00 e9 66 ff ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 66 0f 1f 00 0f 1f 44 00 00 89 f0 <8b> 77 4c 39 c6 7e 1f 48 63 d0 48 8d 14 d7 eb 0b 83 c0 01 48 83 c2
RSP: 0018:ffffa92940003b08 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 000000000000000e
RDX: ffffa92940003be8 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffff8b57471e7800 R08: ffff8b574c642400 R09: 0000000000000002
R10: ffffffffbd820eeb R11: ffffffffbeb7ff00 R12: ffff8b574c642400
R13: 0000000000000001 R14: 0000000000000001 R15: 0000000000000000
FS:  00007fb092ea7640(0000) GS:ffff8b577bc00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000000004c CR3: 00000001020f2005 CR4: 00000000007706f0
PKRU: 55555554
Call Trace:
 <IRQ>
 ? __die+0x23/0x70
 ? page_fault_oops+0x171/0x4e0
 ? exc_page_fault+0x7f/0x180
 ? asm_exc_page_fault+0x26/0x30
 ? aa_label_next_confined+0xb/0x40
 apparmor_secmark_check+0xec/0x330
 security_sock_rcv_skb+0x35/0x50
 sk_filter_trim_cap+0x47/0x250
 sock_queue_rcv_skb_reason+0x20/0x60
 raw_rcv+0x13c/0x210
 raw_local_deliver+0x1f3/0x250
 ip_protocol_deliver_rcu+0x4f/0x2f0
 ip_local_deliver_finish+0x76/0xa0
 __netif_receive_skb_one_core+0x89/0xa0
 netif_receive_skb+0x119/0x170
 ? __netdev_alloc_skb+0x3d/0x140
 vmxnet3_rq_rx_complete+0xb23/0x1010 [vmxnet3 56a84f9c97178c57a43a24ec073b45a9d6f01f3a]
 vmxnet3_poll_rx_only+0x36/0xb0 [vmxnet3 56a84f9c97178c57a43a24ec073b45a9d6f01f3a]
 __napi_poll+0x28/0x1b0
 net_rx_action+0x2a4/0x380
 __do_softirq+0xd1/0x2c8
 __irq_exit_rcu+0xbb/0xf0
 common_interrupt+0x86/0xa0
 </IRQ>
 <TASK>
 asm_common_interrupt+0x26/0x40
RIP: 0010:apparmor_socket_post_create+0xb/0x200
Code: 08 48 85 ff 75 a1 eb b1 0f 1f 80 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 41 54 <55> 48 89 fd 53 45 85 c0 0f 84 b2 00 00 00 48 8b 1d 80 56 3f 02 48
RSP: 0018:ffffa92940ce7e50 EFLAGS: 00000286
RAX: ffffffffbc756440 RBX: 0000000000000000 RCX: 0000000000000001
RDX: 0000000000000003 RSI: 0000000000000002 RDI: ffff8b574eaab740
RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000
R10: ffff8b57444cec70 R11: 0000000000000000 R12: 0000000000000003
R13: 0000000000000002 R14: ffff8b574eaab740 R15: ffffffffbd8e4748
 ? __pfx_apparmor_socket_post_create+0x10/0x10
 security_socket_post_create+0x4b/0x80
 __sock_create+0x176/0x1f0
 __sys_socket+0x89/0x100
 __x64_sys_socket+0x17/0x20
 do_syscall_64+0x5d/0x90
 ? do_syscall_64+0x6c/0x90
 ? do_syscall_64+0x6c/0x90
 ? do_syscall_64+0x6c/0x90
 entry_SYSCALL_64_after_hwframe+0x72/0xdc

openEuler评分:(评分和向量)
5.5
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

受影响版本排查(受影响/不受影响):
1.openEuler-20.03-LTS-SP4:不受影响
2.openEuler-22.03-LTS-SP1:受影响
3.openEuler-22.03-LTS-SP3:受影响
4.openEuler-22.03-LTS-SP4:受影响
5.master(6.1.0):不受影响
6.openEuler-24.03-LTS:受影响
7.openEuler-24.03-LTS-Next:不受影响

修复是否涉及abi变化(是/否)：
1.openEuler-20.03-LTS-SP4:否
2.openEuler-22.03-LTS-SP1:否
3.openEuler-22.03-LTS-SP3:否
4.master(6.1.0):否
5.openEuler-24.03-LTS:否
6.openEuler-24.03-LTS-Next:否
7.openEuler-22.03-LTS-SP4:否

===========================================================

@sanglipeng 经过 cve-manager 解析, 已分析的内容如下表所示:
| 状态  | 需分析 | 内容 |
|:--:|:--:|---------|
|已分析|1.影响性分析说明|In the Linux kernel, the following vulnerability has been resolved:apparmor: Fix null pointer deref when receiving skb during sock creationThe panic below is observed when receiving ICMP packets with secmark setwhile an ICMP raw socket is being created. SK_CTX(sk)->label is updatedin apparmor_socket_post_create(), but the packet is delivered to thesocket before that, causing the null pointer dereference.Drop the packet if label context is not set.    BUG: kernel NULL pointer dereference, address: 000000000000004c    #PF: supervisor read access in kernel mode    #PF: error_code(0x0000) - not-present page    PGD 0 P4D 0    Oops: 0000 [#1] PREEMPT SMP NOPTI    CPU: 0 PID: 407 Comm: a.out Not tainted 6.4.12-arch1-1 #1 3e6fa2753a2d75925c34ecb78e22e85a65d083df    Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 05/28/2020    RIP: 0010:aa_label_next_confined+0xb/0x40    Code: 00 00 48 89 ef e8 d5 25 0c 00 e9 66 ff ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 66 0f 1f 00 0f 1f 44 00 00 89 f0 <8b> 77 4c 39 c6 7e 1f 48 63 d0 48 8d 14 d7 eb 0b 83 c0 01 48 83 c2    RSP: 0018:ffffa92940003b08 EFLAGS: 00010246    RAX: 0000000000000000 RBX: 0000000000000000 RCX: 000000000000000e    RDX: ffffa92940003be8 RSI: 0000000000000000 RDI: 0000000000000000    RBP: ffff8b57471e7800 R08: ffff8b574c642400 R09: 0000000000000002    R10: ffffffffbd820eeb R11: ffffffffbeb7ff00 R12: ffff8b574c642400    R13: 0000000000000001 R14: 0000000000000001 R15: 0000000000000000    FS:  00007fb092ea7640(0000) GS:ffff8b577bc00000(0000) knlGS:0000000000000000    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033    CR2: 000000000000004c CR3: 00000001020f2005 CR4: 00000000007706f0    PKRU: 55555554    Call Trace:     <IRQ>     ? __die+0x23/0x70     ? page_fault_oops+0x171/0x4e0     ? exc_page_fault+0x7f/0x180     ? asm_exc_page_fault+0x26/0x30     ? aa_label_next_confined+0xb/0x40     apparmor_secmark_check+0xec/0x330     security_sock_rcv_skb+0x35/0x50     sk_filter_trim_cap+0x47/0x250     sock_queue_rcv_skb_reason+0x20/0x60     raw_rcv+0x13c/0x210     raw_local_deliver+0x1f3/0x250     ip_protocol_deliver_rcu+0x4f/0x2f0     ip_local_deliver_finish+0x76/0xa0     __netif_receive_skb_one_core+0x89/0xa0     netif_receive_skb+0x119/0x170     ? __netdev_alloc_skb+0x3d/0x140     vmxnet3_rq_rx_complete+0xb23/0x1010 [vmxnet3 56a84f9c97178c57a43a24ec073b45a9d6f01f3a]     vmxnet3_poll_rx_only+0x36/0xb0 [vmxnet3 56a84f9c97178c57a43a24ec073b45a9d6f01f3a]     __napi_poll+0x28/0x1b0     net_rx_action+0x2a4/0x380     __do_softirq+0xd1/0x2c8     __irq_exit_rcu+0xbb/0xf0     common_interrupt+0x86/0xa0     </IRQ>     <TASK>     asm_common_interrupt+0x26/0x40    RIP: 0010:apparmor_socket_post_create+0xb/0x200    Code: 08 48 85 ff 75 a1 eb b1 0f 1f 80 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 41 54 <55> 48 89 fd 53 45 85 c0 0f 84 b2 00 00 00 48 8b 1d 80 56 3f 02 48    RSP: 0018:ffffa92940ce7e50 EFLAGS: 00000286    RAX: ffffffffbc756440 RBX: 0000000000000000 RCX: 0000000000000001    RDX: 0000000000000003 RSI: 0000000000000002 RDI: ffff8b574eaab740    RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000    R10: ffff8b57444cec70 R11: 0000000000000000 R12: 0000000000000003    R13: 0000000000000002 R14: ffff8b574eaab740 R15: ffffffffbd8e4748     ? __pfx_apparmor_socket_post_create+0x10/0x10     security_socket_post_create+0x4b/0x80     __sock_create+0x176/0x1f0     __sys_socket+0x89/0x100     __x64_sys_socket+0x17/0x20     do_syscall_64+0x5d/0x90     ? do_syscall_64+0x6c/0x90     ? do_syscall_64+0x6c/0x90     ? do_syscall_64+0x6c/0x90     entry_SYSCALL_64_after_hwframe+0x72/0xdc|
|已分析|2.openEulerScore|5.5|
|已分析|3.openEulerVector|AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H|
|已分析|4.受影响版本排查|openEuler-22.03-LTS-SP1:受影响,openEuler-22.03-LTS-SP3:受影响,openEuler-22.03-LTS-SP4:受影响,openEuler-24.03-LTS:受影响,openEuler-20.03-LTS-SP4:不受影响,master:不受影响,openEuler-24.03-LTS-Next:不受影响|
|已分析|5.修复是否涉及abi变化|openEuler-20.03-LTS-SP4:否,openEuler-22.03-LTS-SP1:否,openEuler-22.03-LTS-SP3:否,master:否,openEuler-24.03-LTS:否,openEuler-24.03-LTS-Next:否,openEuler-22.03-LTS-SP4:否|

**请确认分析内容的准确性, 确认无误后, 您可以进行后续步骤, 否则您可以继续分析.**

CVE-2023-52889

影响性分析说明：
In the Linux kernel, the following vulnerability has been resolved:

apparmor: Fix null pointer deref when receiving skb during sock creation

The panic below is observed when receiving ICMP packets with secmark set
while an ICMP raw socket is being created. SK_CTX(sk)->label is updated
in apparmor_socket_post_create(), but the packet is delivered to the
socket before that, causing the null pointer dereference.
Drop the packet if label context is not set.

BUG: kernel NULL pointer dereference, address: 000000000000004c
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 0 P4D 0
Oops: 0000 [#1] PREEMPT SMP NOPTI
CPU: 0 PID: 407 Comm: a.out Not tainted 6.4.12-arch1-1 #1 3e6fa2753a2d75925c34ecb78e22e85a65d083df
Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 05/28/2020
RIP: 0010:aa_label_next_confined+0xb/0x40
Code: 00 00 48 89 ef e8 d5 25 0c 00 e9 66 ff ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 66 0f 1f 00 0f 1f 44 00 00 89 f0 <8b> 77 4c 39 c6 7e 1f 48 63 d0 48 8d 14 d7 eb 0b 83 c0 01 48 83 c2
RSP: 0018:ffffa92940003b08 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 000000000000000e
RDX: ffffa92940003be8 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffff8b57471e7800 R08: ffff8b574c642400 R09: 0000000000000002
R10: ffffffffbd820eeb R11: ffffffffbeb7ff00 R12: ffff8b574c642400
R13: 0000000000000001 R14: 0000000000000001 R15: 0000000000000000
FS:  00007fb092ea7640(0000) GS:ffff8b577bc00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000000004c CR3: 00000001020f2005 CR4: 00000000007706f0
PKRU: 55555554
Call Trace:
 <IRQ>
 ? __die+0x23/0x70
 ? page_fault_oops+0x171/0x4e0
 ? exc_page_fault+0x7f/0x180
 ? asm_exc_page_fault+0x26/0x30
 ? aa_label_next_confined+0xb/0x40
 apparmor_secmark_check+0xec/0x330
 security_sock_rcv_skb+0x35/0x50
 sk_filter_trim_cap+0x47/0x250
 sock_queue_rcv_skb_reason+0x20/0x60
 raw_rcv+0x13c/0x210
 raw_local_deliver+0x1f3/0x250
 ip_protocol_deliver_rcu+0x4f/0x2f0
 ip_local_deliver_finish+0x76/0xa0
 __netif_receive_skb_one_core+0x89/0xa0
 netif_receive_skb+0x119/0x170
 ? __netdev_alloc_skb+0x3d/0x140
 vmxnet3_rq_rx_complete+0xb23/0x1010 [vmxnet3 56a84f9c97178c57a43a24ec073b45a9d6f01f3a]
 vmxnet3_poll_rx_only+0x36/0xb0 [vmxnet3 56a84f9c97178c57a43a24ec073b45a9d6f01f3a]
 __napi_poll+0x28/0x1b0
 net_rx_action+0x2a4/0x380
 __do_softirq+0xd1/0x2c8
 __irq_exit_rcu+0xbb/0xf0
 common_interrupt+0x86/0xa0
 </IRQ>
 <TASK>
 asm_common_interrupt+0x26/0x40
RIP: 0010:apparmor_socket_post_create+0xb/0x200
Code: 08 48 85 ff 75 a1 eb b1 0f 1f 80 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 41 54 <55> 48 89 fd 53 45 85 c0 0f 84 b2 00 00 00 48 8b 1d 80 56 3f 02 48
RSP: 0018:ffffa92940ce7e50 EFLAGS: 00000286
RAX: ffffffffbc756440 RBX: 0000000000000000 RCX: 0000000000000001
RDX: 0000000000000003 RSI: 0000000000000002 RDI: ffff8b574eaab740
RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000
R10: ffff8b57444cec70 R11: 0000000000000000 R12: 0000000000000003
R13: 0000000000000002 R14: ffff8b574eaab740 R15: ffffffffbd8e4748
 ? __pfx_apparmor_socket_post_create+0x10/0x10
 security_socket_post_create+0x4b/0x80
 __sock_create+0x176/0x1f0
 __sys_socket+0x89/0x100
 __x64_sys_socket+0x17/0x20
 do_syscall_64+0x5d/0x90
 ? do_syscall_64+0x6c/0x90
 ? do_syscall_64+0x6c/0x90
 ? do_syscall_64+0x6c/0x90
 entry_SYSCALL_64_after_hwframe+0x72/0xdc

openEuler评分:(评分和向量)
5.5
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

受影响版本排查(受影响/不受影响):
1.openEuler-20.03-LTS-SP4:不受影响
2.openEuler-22.03-LTS-SP1:受影响
3.openEuler-22.03-LTS-SP3:受影响
4.openEuler-22.03-LTS-SP4:受影响
5.master(6.1.0):不受影响
6.openEuler-24.03-LTS:受影响
7.openEuler-24.03-LTS-Next:不受影响

修复是否涉及abi变化(是/否)：
1.openEuler-20.03-LTS-SP4:否
2.openEuler-22.03-LTS-SP1:否
3.openEuler-22.03-LTS-SP3:否
4.master(6.1.0):否
5.openEuler-24.03-LTS:否
6.openEuler-24.03-LTS-Next:否
7.openEuler-22.03-LTS-SP4:否

===========================================================

@sanglipeng 经过 cve-manager 解析, 已分析的内容如下表所示:
| 状态  | 需分析 | 内容 |
|:--:|:--:|---------|
|已分析|1.影响性分析说明|In the Linux kernel, the following vulnerability has been resolved:apparmor: Fix null pointer deref when receiving skb during sock creationThe panic below is observed when receiving ICMP packets with secmark setwhile an ICMP raw socket is being created. SK_CTX(sk)->label is updatedin apparmor_socket_post_create(), but the packet is delivered to thesocket before that, causing the null pointer dereference.Drop the packet if label context is not set.    BUG: kernel NULL pointer dereference, address: 000000000000004c    #PF: supervisor read access in kernel mode    #PF: error_code(0x0000) - not-present page    PGD 0 P4D 0    Oops: 0000 [#1] PREEMPT SMP NOPTI    CPU: 0 PID: 407 Comm: a.out Not tainted 6.4.12-arch1-1 #1 3e6fa2753a2d75925c34ecb78e22e85a65d083df    Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 05/28/2020    RIP: 0010:aa_label_next_confined+0xb/0x40    Code: 00 00 48 89 ef e8 d5 25 0c 00 e9 66 ff ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 66 0f 1f 00 0f 1f 44 00 00 89 f0 <8b> 77 4c 39 c6 7e 1f 48 63 d0 48 8d 14 d7 eb 0b 83 c0 01 48 83 c2    RSP: 0018:ffffa92940003b08 EFLAGS: 00010246    RAX: 0000000000000000 RBX: 0000000000000000 RCX: 000000000000000e    RDX: ffffa92940003be8 RSI: 0000000000000000 RDI: 0000000000000000    RBP: ffff8b57471e7800 R08: ffff8b574c642400 R09: 0000000000000002    R10: ffffffffbd820eeb R11: ffffffffbeb7ff00 R12: ffff8b574c642400    R13: 0000000000000001 R14: 0000000000000001 R15: 0000000000000000    FS:  00007fb092ea7640(0000) GS:ffff8b577bc00000(0000) knlGS:0000000000000000    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033    CR2: 000000000000004c CR3: 00000001020f2005 CR4: 00000000007706f0    PKRU: 55555554    Call Trace:     <IRQ>     ? __die+0x23/0x70     ? page_fault_oops+0x171/0x4e0     ? exc_page_fault+0x7f/0x180     ? asm_exc_page_fault+0x26/0x30     ? aa_label_next_confined+0xb/0x40     apparmor_secmark_check+0xec/0x330     security_sock_rcv_skb+0x35/0x50     sk_filter_trim_cap+0x47/0x250     sock_queue_rcv_skb_reason+0x20/0x60     raw_rcv+0x13c/0x210     raw_local_deliver+0x1f3/0x250     ip_protocol_deliver_rcu+0x4f/0x2f0     ip_local_deliver_finish+0x76/0xa0     __netif_receive_skb_one_core+0x89/0xa0     netif_receive_skb+0x119/0x170     ? __netdev_alloc_skb+0x3d/0x140     vmxnet3_rq_rx_complete+0xb23/0x1010 [vmxnet3 56a84f9c97178c57a43a24ec073b45a9d6f01f3a]     vmxnet3_poll_rx_only+0x36/0xb0 [vmxnet3 56a84f9c97178c57a43a24ec073b45a9d6f01f3a]     __napi_poll+0x28/0x1b0     net_rx_action+0x2a4/0x380     __do_softirq+0xd1/0x2c8     __irq_exit_rcu+0xbb/0xf0     common_interrupt+0x86/0xa0     </IRQ>     <TASK>     asm_common_interrupt+0x26/0x40    RIP: 0010:apparmor_socket_post_create+0xb/0x200    Code: 08 48 85 ff 75 a1 eb b1 0f 1f 80 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 41 54 <55> 48 89 fd 53 45 85 c0 0f 84 b2 00 00 00 48 8b 1d 80 56 3f 02 48    RSP: 0018:ffffa92940ce7e50 EFLAGS: 00000286    RAX: ffffffffbc756440 RBX: 0000000000000000 RCX: 0000000000000001    RDX: 0000000000000003 RSI: 0000000000000002 RDI: ffff8b574eaab740    RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000    R10: ffff8b57444cec70 R11: 0000000000000000 R12: 0000000000000003    R13: 0000000000000002 R14: ffff8b574eaab740 R15: ffffffffbd8e4748     ? __pfx_apparmor_socket_post_create+0x10/0x10     security_socket_post_create+0x4b/0x80     __sock_create+0x176/0x1f0     __sys_socket+0x89/0x100     __x64_sys_socket+0x17/0x20     do_syscall_64+0x5d/0x90     ? do_syscall_64+0x6c/0x90     ? do_syscall_64+0x6c/0x90     ? do_syscall_64+0x6c/0x90     entry_SYSCALL_64_after_hwframe+0x72/0xdc|
|已分析|2.openEulerScore|5.5|
|已分析|3.openEulerVector|AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H|
|已分析|4.受影响版本排查|openEuler-22.03-LTS-SP1:受影响,openEuler-22.03-LTS-SP3:受影响,openEuler-22.03-LTS-SP4:受影响,openEuler-24.03-LTS:受影响,openEuler-20.03-LTS-SP4:不受影响,master:不受影响,openEuler-24.03-LTS-Next:不受影响|
|已分析|5.修复是否涉及abi变化|openEuler-20.03-LTS-SP4:否,openEuler-22.03-LTS-SP1:否,openEuler-22.03-LTS-SP3:否,master:否,openEuler-24.03-LTS:否,openEuler-24.03-LTS-Next:否,openEuler-22.03-LTS-SP4:否|

**请确认分析内容的准确性, 确认无误后, 您可以进行后续步骤, 否则您可以继续分析.**

src-openEuler/kernel

内容风险标识

评论 (26)

src-openEuler/kernel .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2023-52889

评论 (26)

搜索帮助

src-openEuler/kernel