CVE-2023-52894

一、漏洞信息
 漏洞编号：[CVE-2023-52894](https://nvd.nist.gov/vuln/detail/CVE-2023-52894)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.0,6.1.14,6.1.19,6.1.5,6.1.6,6.1.8,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：5.5 Medium
  Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:usb: gadget: f_ncm: fix potential NULL ptr deref in ncm_bitrate()In Google internal bug 265639009 we ve received an (as yet) unreproduciblecrash report from an aarch64 GKI 5.10.149-android13 running device.AFAICT the source code is at:  https://android.googlesource.com/kernel/common/+/refs/tags/ASB-2022-12-05_13-5.10The call stack is:  ncm_close() -> ncm_notify() -> ncm_do_notify()with the crash at:  ncm_do_notify+0x98/0x270Code: 79000d0b b9000a6c f940012a f9400269 (b9405d4b)Which I believe disassembles to (I don t know ARM assembly, but it looks sane enough to me...):  // halfword (16-bit) store presumably to event->wLength (at offset 6 of struct usb_cdc_notification)  0B 0D 00 79    strh w11, [x8, #6]  // word (32-bit) store presumably to req->Length (at offset 8 of struct usb_request)  6C 0A 00 B9    str  w12, [x19, #8]  // x10 (NULL) was read here from offset 0 of valid pointer x9  // IMHO we re reading  cdev->gadget  and getting NULL  // gadget is indeed at offset 0 of struct usb_composite_dev  2A 01 40 F9    ldr  x10, [x9]  // loading req->buf pointer, which is at offset 0 of struct usb_request  69 02 40 F9    ldr  x9, [x19]  // x10 is null, crash, appears to be attempt to read cdev->gadget->max_speed  4B 5D 40 B9    ldr  w11, [x10, #0x5c]which seems to line up with ncm_do_notify() case NCM_NOTIFY_SPEED code fragment:  event->wLength = cpu_to_le16(8);  req->length = NCM_STATUS_BYTECOUNT;  /* SPEED_CHANGE data is up/down speeds in bits/sec */  data = req->buf + sizeof *event;  data[0] = cpu_to_le32(ncm_bitrate(cdev->gadget));My analysis of registers and NULL ptr deref crash offset  (Unable to handle kernel NULL pointer dereference at virtual address 000000000000005c)heavily suggests that the crash is due to  cdev->gadget  being NULL when executing:  data[0] = cpu_to_le32(ncm_bitrate(cdev->gadget));which calls:  ncm_bitrate(NULL)which then calls:  gadget_is_superspeed(NULL)which reads  ((struct usb_gadget *)NULL)->max_speedand hits a panic.AFAICT, if I m counting right, the offset of max_speed is indeed 0x5C.(remember there s a GKI KABI reservation of 16 bytes in struct work_struct)It s not at all clear to me how this is all supposed to work...but returning 0 seems much better than panic-ing...
 漏洞公开时间：2024-08-21 15:15:05
 漏洞创建时间：2024-08-21 23:45:49
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2023-52894
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/09e4507ec8ef2d44da6ba4092b8ee2d81f216497 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/63d161f29cd39c050e8873aa36e0c9fc013bb763 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/a21da7f7aae618c785f7e4a275d43c06dc8412b6 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/a69c8dfb85b44be9cc223be07d35cc3a9baefbea |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/c6ec929595c7443250b2a4faea988c62019d5cd2 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/e92c70059178da751e5af7de02384b7dfadb5ec7 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/fef6b29671b66dfb71f17e337c1ad14b5a2cedae |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-52894 | https://bugzilla.suse.com/show_bug.cgi?id=1229566 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2023-52894 | https://bugzilla.suse.com/show_bug.cgi?id=1229566 |
| suse_bugzilla | https://git.kernel.org/stable/c/09e4507ec8ef2d44da6ba4092b8ee2d81f216497 | https://bugzilla.suse.com/show_bug.cgi?id=1229566 |
| suse_bugzilla | https://git.kernel.org/stable/c/63d161f29cd39c050e8873aa36e0c9fc013bb763 | https://bugzilla.suse.com/show_bug.cgi?id=1229566 |
| suse_bugzilla | https://git.kernel.org/stable/c/a21da7f7aae618c785f7e4a275d43c06dc8412b6 | https://bugzilla.suse.com/show_bug.cgi?id=1229566 |
| suse_bugzilla | https://git.kernel.org/stable/c/a69c8dfb85b44be9cc223be07d35cc3a9baefbea | https://bugzilla.suse.com/show_bug.cgi?id=1229566 |
| suse_bugzilla | https://git.kernel.org/stable/c/c6ec929595c7443250b2a4faea988c62019d5cd2 | https://bugzilla.suse.com/show_bug.cgi?id=1229566 |
| suse_bugzilla | https://git.kernel.org/stable/c/e92c70059178da751e5af7de02384b7dfadb5ec7 | https://bugzilla.suse.com/show_bug.cgi?id=1229566 |
| suse_bugzilla | https://git.kernel.org/stable/c/fef6b29671b66dfb71f17e337c1ad14b5a2cedae | https://bugzilla.suse.com/show_bug.cgi?id=1229566 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2023/CVE-2023-52894.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1229566 |
| ubuntu | https://www.cve.org/CVERecord?id=CVE-2023-52894 | https://ubuntu.com/security/CVE-2023-52894 |
| ubuntu | https://git.kernel.org/linus/c6ec929595c7443250b2a4faea988c62019d5cd2 (6.2-rc5) | https://ubuntu.com/security/CVE-2023-52894 |
| ubuntu | https://git.kernel.org/stable/c/fef6b29671b66dfb71f17e337c1ad14b5a2cedae | https://ubuntu.com/security/CVE-2023-52894 |
| ubuntu | https://git.kernel.org/stable/c/63d161f29cd39c050e8873aa36e0c9fc013bb763 | https://ubuntu.com/security/CVE-2023-52894 |
| ubuntu | https://git.kernel.org/stable/c/a21da7f7aae618c785f7e4a275d43c06dc8412b6 | https://ubuntu.com/security/CVE-2023-52894 |
| ubuntu | https://git.kernel.org/stable/c/e92c70059178da751e5af7de02384b7dfadb5ec7 | https://ubuntu.com/security/CVE-2023-52894 |
| ubuntu | https://git.kernel.org/stable/c/a69c8dfb85b44be9cc223be07d35cc3a9baefbea | https://ubuntu.com/security/CVE-2023-52894 |
| ubuntu | https://git.kernel.org/stable/c/09e4507ec8ef2d44da6ba4092b8ee2d81f216497 | https://ubuntu.com/security/CVE-2023-52894 |
| ubuntu | https://git.kernel.org/stable/c/c6ec929595c7443250b2a4faea988c62019d5cd2 | https://ubuntu.com/security/CVE-2023-52894 |
| ubuntu | https://nvd.nist.gov/vuln/detail/CVE-2023-52894 | https://ubuntu.com/security/CVE-2023-52894 |
| ubuntu | https://launchpad.net/bugs/cve/CVE-2023-52894 | https://ubuntu.com/security/CVE-2023-52894 |
| ubuntu | https://security-tracker.debian.org/tracker/CVE-2023-52894 | https://ubuntu.com/security/CVE-2023-52894 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2023-52894 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://git.kernel.org/stable/c/09e4507ec8ef2d44da6ba4092b8ee2d81f216497 |  | nvd |
|  |  | https://git.kernel.org/stable/c/63d161f29cd39c050e8873aa36e0c9fc013bb763 |  | nvd |
|  |  | https://git.kernel.org/stable/c/a21da7f7aae618c785f7e4a275d43c06dc8412b6 |  | nvd |
|  |  | https://git.kernel.org/stable/c/a69c8dfb85b44be9cc223be07d35cc3a9baefbea |  | nvd |
|  |  | https://git.kernel.org/stable/c/c6ec929595c7443250b2a4faea988c62019d5cd2 |  | nvd |
|  |  | https://git.kernel.org/stable/c/e92c70059178da751e5af7de02384b7dfadb5ec7 |  | nvd |
|  |  | https://git.kernel.org/stable/c/fef6b29671b66dfb71f17e337c1ad14b5a2cedae |  | nvd |
| linux |  | https://git.kernel.org/linus/c6ec929595c7443250b2a4faea988c62019d5cd2 | https://git.kernel.org/linus/1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 | ubuntu |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
    In the Linux kernel, the following vulnerability has been resolved:usb: gadget: f_ncm: fix potential NULL ptr deref in ncm_bitrate()In Google internal bug 265639009 we ve received an (as yet) unreproduciblecrash report from an aarch64 GKI 5.10.149-android13 running device.AFAICT the source code is at:  https://android.googlesource.com/kernel/common/+/refs/tags/ASB-2022-12-05_13-5.10The call stack is:  ncm_close() -> ncm_notify() -> ncm_do_notify()with the crash at:  ncm_do_notify+0x98/0x270Code: 79000d0b b9000a6c f940012a f9400269 (b9405d4b)Which I believe disassembles to (I don t know ARM assembly, but it looks sane enough to me...):  // halfword (16-bit) store presumably to event->wLength (at offset 6 of struct usb_cdc_notification)  0B 0D 00 79    strh w11, [x8, #6]  // word (32-bit) store presumably to req->Length (at offset 8 of struct usb_request)  6C 0A 00 B9    str  w12, [x19, #8]  // x10 (NULL) was read here from offset 0 of valid pointer x9  // IMHO we re reading  cdev->gadget  and getting NULL  // gadget is indeed at offset 0 of struct usb_composite_dev  2A 01 40 F9    ldr  x10, [x9]  // loading req->buf pointer, which is at offset 0 of struct usb_request  69 02 40 F9    ldr  x9, [x19]  // x10 is null, crash, appears to be attempt to read cdev->gadget->max_speed  4B 5D 40 B9    ldr  w11, [x10, #0x5c]which seems to line up with ncm_do_notify() case NCM_NOTIFY_SPEED code fragment:  event->wLength = cpu_to_le16(8);  req->length = NCM_STATUS_BYTECOUNT;  /* SPEED_CHANGE data is up/down speeds in bits/sec */  data = req->buf + sizeof *event;  data[0] = cpu_to_le32(ncm_bitrate(cdev->gadget));My analysis of registers and NULL ptr deref crash offset  (Unable to handle kernel NULL pointer dereference at virtual address 000000000000005c)heavily suggests that the crash is due to  cdev->gadget  being NULL when executing:  data[0] = cpu_to_le32(ncm_bitrate(cdev->gadget));which calls:  ncm_bitrate(NULL)which then calls:  gadget_is_superspeed(NULL)which reads  ((struct usb_gadget *)NULL)->max_speedand hits a panic.AFAICT, if I m counting right, the offset of max_speed is indeed 0x5C.(remember there s a GKI KABI reservation of 16 bytes in struct work_struct)It s not at all clear to me how this is all supposed to work...but returning 0 seems much better than panic-ing... 
 openEuler评分：
  5.5
 Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP4(4.19.90):受影响
2.openEuler-22.03-LTS-SP1(5.10.0):受影响
3.openEuler-22.03-LTS-SP3(5.10.0):不受影响
4.openEuler-22.03-LTS-SP4(5.10.0):不受影响
5.master(6.6.0):不受影响
6.openEuler-24.03-LTS(6.6.0):不受影响
7.openEuler-24.03-LTS-Next(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP4(4.19.90):否
2.openEuler-22.03-LTS-SP1(5.10.0):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.master(6.6.0):否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-22.03-LTS-SP4(5.10.0):否

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2024-2185

src-openEuler / kernel
Closed

Content Risk Flag

Comments (22)

src-openEuler / kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2023-52894

Comments (22)

Search

src-openEuler / kernel
Closed