CVE-2023-52906

一、漏洞信息
 漏洞编号：[CVE-2023-52906](https://nvd.nist.gov/vuln/detail/CVE-2023-52906)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.0,6.1.14,6.1.19,6.1.5,6.1.6,6.1.8,6.4.0,6.6.0
 CVSS V2.0分值：
  BaseScore：0.0 None
  Vector：CVSS：2.0/
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:net/sched: act_mpls: Fix warning during failed attribute validationThe  TCA_MPLS_LABEL  attribute is of  NLA_U32  type, but has avalidation type of  NLA_VALIDATE_FUNCTION . This is an invalidcombination according to the comment above  struct nla_policy : Meaning of `validate  field, use via NLA_POLICY_VALIDATE_FN:   NLA_BINARY           Validation function called for the attribute.   All other            Unused - but note that it s a union This can trigger the warning [1] in nla_get_range_unsigned() whenvalidation of the attribute fails. Despite being of  NLA_U32  type, theassociated  min / max  fields in the policy are negative as they arealiased by the  validate  field.Fix by changing the attribute type to  NLA_BINARY  which is consistentwith the above comment and all other users of NLA_POLICY_VALIDATE_FN().As a result, move the length validation to the validation function.No regressions in MPLS tests: # ./tdc.py -f tc-tests/actions/mpls.json [...] # echo $? 0[1]WARNING: CPU: 0 PID: 17743 at lib/nlattr.c:118nla_get_range_unsigned+0x1d8/0x1e0 lib/nlattr.c:117Modules linked in:CPU: 0 PID: 17743 Comm: syz-executor.0 Not tainted 6.1.0-rc8 #3Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOSrel-1.13.0-48-gd9c812dda519-prebuilt.qemu.org 04/01/2014RIP: 0010:nla_get_range_unsigned+0x1d8/0x1e0 lib/nlattr.c:117[...]Call Trace: <TASK> __netlink_policy_dump_write_attr+0x23d/0x990 net/netlink/policy.c:310 netlink_policy_dump_write_attr+0x22/0x30 net/netlink/policy.c:411 netlink_ack_tlv_fill net/netlink/af_netlink.c:2454 [inline] netlink_ack+0x546/0x760 net/netlink/af_netlink.c:2506 netlink_rcv_skb+0x1b7/0x240 net/netlink/af_netlink.c:2546 rtnetlink_rcv+0x18/0x20 net/core/rtnetlink.c:6109 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x5e9/0x6b0 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x739/0x860 net/netlink/af_netlink.c:1921 sock_sendmsg_nosec net/socket.c:714 [inline] sock_sendmsg net/socket.c:734 [inline] ____sys_sendmsg+0x38f/0x500 net/socket.c:2482 ___sys_sendmsg net/socket.c:2536 [inline] __sys_sendmsg+0x197/0x230 net/socket.c:2565 __do_sys_sendmsg net/socket.c:2574 [inline] __se_sys_sendmsg net/socket.c:2572 [inline] __x64_sys_sendmsg+0x42/0x50 net/socket.c:2572 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd
 漏洞公开时间：2024-08-21 15:15:06
 漏洞创建时间：2024-08-22 03:52:31
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2023-52906
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/2b157c3c5d6b8ddca48d53c9e662032f65af8d61 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/453277feb41c2235cf2c0de9209eef962c401457 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/8a97b544b98e44f596219ebb290fd2ba2fd5d644 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/9e17f99220d111ea031b44153fdfe364b0024ff2 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/9e2c38827cdc6fdd3bb375c8607fc04d289756f9 |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-52906 | https://bugzilla.suse.com/show_bug.cgi?id=1229527 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2023-52906 | https://bugzilla.suse.com/show_bug.cgi?id=1229527 |
| suse_bugzilla | https://git.kernel.org/stable/c/2b157c3c5d6b8ddca48d53c9e662032f65af8d61 | https://bugzilla.suse.com/show_bug.cgi?id=1229527 |
| suse_bugzilla | https://git.kernel.org/stable/c/453277feb41c2235cf2c0de9209eef962c401457 | https://bugzilla.suse.com/show_bug.cgi?id=1229527 |
| suse_bugzilla | https://git.kernel.org/stable/c/8a97b544b98e44f596219ebb290fd2ba2fd5d644 | https://bugzilla.suse.com/show_bug.cgi?id=1229527 |
| suse_bugzilla | https://git.kernel.org/stable/c/9e17f99220d111ea031b44153fdfe364b0024ff2 | https://bugzilla.suse.com/show_bug.cgi?id=1229527 |
| suse_bugzilla | https://git.kernel.org/stable/c/9e2c38827cdc6fdd3bb375c8607fc04d289756f9 | https://bugzilla.suse.com/show_bug.cgi?id=1229527 |
| ubuntu | https://www.cve.org/CVERecord?id=CVE-2023-52906 | https://ubuntu.com/security/CVE-2023-52906 |
| ubuntu | https://git.kernel.org/linus/9e17f99220d111ea031b44153fdfe364b0024ff2 (6.2-rc4) | https://ubuntu.com/security/CVE-2023-52906 |
| ubuntu | https://git.kernel.org/stable/c/2b157c3c5d6b8ddca48d53c9e662032f65af8d61 | https://ubuntu.com/security/CVE-2023-52906 |
| ubuntu | https://git.kernel.org/stable/c/453277feb41c2235cf2c0de9209eef962c401457 | https://ubuntu.com/security/CVE-2023-52906 |
| ubuntu | https://git.kernel.org/stable/c/9e2c38827cdc6fdd3bb375c8607fc04d289756f9 | https://ubuntu.com/security/CVE-2023-52906 |
| ubuntu | https://git.kernel.org/stable/c/8a97b544b98e44f596219ebb290fd2ba2fd5d644 | https://ubuntu.com/security/CVE-2023-52906 |
| ubuntu | https://git.kernel.org/stable/c/9e17f99220d111ea031b44153fdfe364b0024ff2 | https://ubuntu.com/security/CVE-2023-52906 |
| ubuntu | https://nvd.nist.gov/vuln/detail/CVE-2023-52906 | https://ubuntu.com/security/CVE-2023-52906 |
| ubuntu | https://launchpad.net/bugs/cve/CVE-2023-52906 | https://ubuntu.com/security/CVE-2023-52906 |
| ubuntu | https://security-tracker.debian.org/tracker/CVE-2023-52906 | https://ubuntu.com/security/CVE-2023-52906 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2023-52906 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
| linux |  | https://git.kernel.org/linus/9e17f99220d111ea031b44153fdfe364b0024ff2 | https://git.kernel.org/linus/2a2ea50870baa3fb4de0872c5b60828138654ca7 | ubuntu |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
    In the Linux kernel, the following vulnerability has been resolved:net/sched: act_mpls: Fix warning during failed attribute validationThe &#39;TCA_MPLS_LABEL&#39; attribute is of &#39;NLA_U32&#39; type, but has avalidation type of &#39;NLA_VALIDATE_FUNCTION&#39;. This is an invalidcombination according to the comment above &#39;struct nla_policy&#39;:&#34;Meaning of `validate&#39; field, use via NLA_POLICY_VALIDATE_FN:   NLA_BINARY           Validation function called for the attribute.   All other            Unused - but note that it&#39;s a union&#34;This can trigger the warning [1] in nla_get_range_unsigned() whenvalidation of the attribute fails. Despite being of &#39;NLA_U32&#39; type, theassociated &#39;min&#39;/&#39;max&#39; fields in the policy are negative as they arealiased by the &#39;validate&#39; field.Fix by changing the attribute type to &#39;NLA_BINARY&#39; which is consistentwith the above comment and all other users of NLA_POLICY_VALIDATE_FN().As a result, move the length validation to the validation function.No regressions in MPLS tests: # ./tdc.py -f tc-tests/actions/mpls.json [...] # echo $? 0[1]WARNING: CPU: 0 PID: 17743 at lib/nlattr.c:118nla_get_range_unsigned+0x1d8/0x1e0 lib/nlattr.c:117Modules linked in:CPU: 0 PID: 17743 Comm: syz-executor.0 Not tainted 6.1.0-rc8 #3Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOSrel-1.13.0-48-gd9c812dda519-prebuilt.qemu.org 04/01/2014RIP: 0010:nla_get_range_unsigned+0x1d8/0x1e0 lib/nlattr.c:117[...]Call Trace: &lt;TASK&gt; __netlink_policy_dump_write_attr+0x23d/0x990 net/netlink/policy.c:310 netlink_policy_dump_write_attr+0x22/0x30 net/netlink/policy.c:411 netlink_ack_tlv_fill net/netlink/af_netlink.c:2454 [inline] netlink_ack+0x546/0x760 net/netlink/af_netlink.c:2506 netlink_rcv_skb+0x1b7/0x240 net/netlink/af_netlink.c:2546 rtnetlink_rcv+0x18/0x20 net/core/rtnetlink.c:6109 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x5e9/0x6b0 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x739/0x860 net/netlink/af_netlink.c:1921 sock_sendmsg_nosec net/socket.c:714 [inline] sock_sendmsg net/socket.c:734 [inline] ____sys_sendmsg+0x38f/0x500 net/socket.c:2482 ___sys_sendmsg net/socket.c:2536 [inline] __sys_sendmsg+0x197/0x230 net/socket.c:2565 __do_sys_sendmsg net/socket.c:2574 [inline] __se_sys_sendmsg net/socket.c:2572 [inline] __x64_sys_sendmsg+0x42/0x50 net/socket.c:2572 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcdThe Linux kernel CVE team has assigned CVE-2023-52906 to this issue. 
 openEuler评分：
  5.5
 Vector：CVSS：2.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-22.03-LTS-SP1(5.10.0):受影响
2.openEuler-20.03-LTS-SP4(4.19.90):不受影响
3.openEuler-22.03-LTS-SP3(5.10.0):不受影响
4.openEuler-22.03-LTS-SP4(5.10.0):不受影响
5.master(6.6.0):不受影响
6.openEuler-24.03-LTS(6.6.0):不受影响
7.openEuler-24.03-LTS-Next(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP4(4.19.90):否
2.openEuler-22.03-LTS-SP1(5.10.0):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.master(6.6.0):否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-22.03-LTS-SP4(5.10.0):否

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2024-2106

src-openEuler / kernel
Closed

Content Risk Flag

Comments (11)

src-openEuler / kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2023-52906

Comments (11)

Search

src-openEuler / kernel
Closed