CVE-2024-45025

一、漏洞信息
 漏洞编号：[CVE-2024-45025](https://nvd.nist.gov/vuln/detail/CVE-2024-45025)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.0,6.1.14,6.1.19,6.1.5,6.1.6,6.1.8,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：5.5 Medium
  Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHAREcopy_fd_bitmaps(new, old, count) is expected to copy the firstcount/BITS_PER_LONG bits from old->full_fds_bits[] and fillthe rest with zeroes.  What it does is copying enough words(BITS_TO_LONGS(count/BITS_PER_LONG)), then memsets the rest.That works fine, *if* all bits past the cutoff point areclear.  Otherwise we are risking garbage from the last wordwe d copied.For most of the callers that is true - expand_fdtable() hascount equal to old->max_fds, so there s no open descriptorspast count, let alone fully occupied words in ->open_fds[],which is what bits in ->full_fds_bits[] correspond to.The other caller (dup_fd()) passes sane_fdtable_size(old_fdt, max_fds),which is the smallest multiple of BITS_PER_LONG that covers allopened descriptors below max_fds.  In the common case (copying onfork()) max_fds is ~0U, so all opened descriptors will be belowit and we are fine, by the same reasons why the call in expand_fdtable()is safe.Unfortunately, there is a case where max_fds is less than thatand where we might, indeed, end up with junk in ->full_fds_bits[] -close_range(from, to, CLOSE_RANGE_UNSHARE) with	* descriptor table being currently shared	*  to  being above the current capacity of descriptor table	*  from  being just under some chunk of opened descriptors.In that case we end up with observably wrong behaviour - e.g. spawna child with CLONE_FILES, get all descriptors in range 0..127 open,then close_range(64, ~0U, CLOSE_RANGE_UNSHARE) and watch dup(0) endingup with descriptor #128, despite #64 being observably not open.The minimally invasive fix would be to deal with that in dup_fd().If this proves to add measurable overhead, we can go that way, butlet s try to fix copy_fd_bitmaps() first.* new helper: bitmap_copy_and_expand(to, from, bits_to_copy, size).* make copy_fd_bitmaps() take the bitmap size in words, rather thanbits; it s  count  argument is always a multiple of BITS_PER_LONG,so we are not losing any information, and that way we can use thesame helper for all three bitmaps - compiler will see that countis a multiple of BITS_PER_LONG for the large ones, so it ll generateplain memcpy()+memset().Reproducer added to tools/testing/selftests/core/close_range_test.c
 漏洞公开时间：2024-09-12 00:15:07
 漏洞创建时间：2024-09-12 08:39:58
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2024-45025
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/5053581fe5dfb09b58c65dd8462bf5dea71f41ff |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/8cad3b2b3ab81ca55f37405ffd1315bcc2948058 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/9a2fa1472083580b6c66bdaf291f591e1170123a |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/c69d18f0ac7060de724511537810f10f29a27958 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/dd72ae8b0fce9c0bbe9582b9b50820f0407f8d8a |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/e807487a1d5fd5d941f26578ae826ca815dbfcd6 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/ee501f827f3db02d4e599afbbc1a7f8b792d05d7 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/fe5bf14881701119aeeda7cf685f3c226c7380df |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-45025 | https://bugzilla.suse.com/show_bug.cgi?id=1230456 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2024/CVE-2024-45025.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1230456 |
| suse_bugzilla | https://git.kernel.org/stable/c/ee501f827f3db02d4e599afbbc1a7f8b792d05d7 | https://bugzilla.suse.com/show_bug.cgi?id=1230456 |
| suse_bugzilla | https://git.kernel.org/stable/c/e807487a1d5fd5d941f26578ae826ca815dbfcd6 | https://bugzilla.suse.com/show_bug.cgi?id=1230456 |
| suse_bugzilla | https://git.kernel.org/stable/c/fe5bf14881701119aeeda7cf685f3c226c7380df | https://bugzilla.suse.com/show_bug.cgi?id=1230456 |
| suse_bugzilla | https://git.kernel.org/stable/c/5053581fe5dfb09b58c65dd8462bf5dea71f41ff | https://bugzilla.suse.com/show_bug.cgi?id=1230456 |
| suse_bugzilla | https://git.kernel.org/stable/c/8cad3b2b3ab81ca55f37405ffd1315bcc2948058 | https://bugzilla.suse.com/show_bug.cgi?id=1230456 |
| suse_bugzilla | https://git.kernel.org/stable/c/dd72ae8b0fce9c0bbe9582b9b50820f0407f8d8a | https://bugzilla.suse.com/show_bug.cgi?id=1230456 |
| suse_bugzilla | https://git.kernel.org/stable/c/c69d18f0ac7060de724511537810f10f29a27958 | https://bugzilla.suse.com/show_bug.cgi?id=1230456 |
| suse_bugzilla | https://git.kernel.org/stable/c/9a2fa1472083580b6c66bdaf291f591e1170123a | https://bugzilla.suse.com/show_bug.cgi?id=1230456 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2024-45025 | https://bugzilla.suse.com/show_bug.cgi?id=1230456 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2311722 | https://bugzilla.suse.com/show_bug.cgi?id=1230456 |
| redhat_bugzilla | https://lore.kernel.org/linux-cve-announce/2024091109-CVE-2024-45025-94f6@gregkh/T | https://bugzilla.redhat.com/show_bug.cgi?id=2311722 |
| ubuntu | https://www.cve.org/CVERecord?id=CVE-2024-45025 | https://ubuntu.com/security/CVE-2024-45025 |
| ubuntu | https://git.kernel.org/linus/9a2fa1472083580b6c66bdaf291f591e1170123a (6.11-rc4) | https://ubuntu.com/security/CVE-2024-45025 |
| ubuntu | https://git.kernel.org/stable/c/ee501f827f3db02d4e599afbbc1a7f8b792d05d7 | https://ubuntu.com/security/CVE-2024-45025 |
| ubuntu | https://git.kernel.org/stable/c/e807487a1d5fd5d941f26578ae826ca815dbfcd6 | https://ubuntu.com/security/CVE-2024-45025 |
| ubuntu | https://git.kernel.org/stable/c/fe5bf14881701119aeeda7cf685f3c226c7380df | https://ubuntu.com/security/CVE-2024-45025 |
| ubuntu | https://git.kernel.org/stable/c/5053581fe5dfb09b58c65dd8462bf5dea71f41ff | https://ubuntu.com/security/CVE-2024-45025 |
| ubuntu | https://git.kernel.org/stable/c/8cad3b2b3ab81ca55f37405ffd1315bcc2948058 | https://ubuntu.com/security/CVE-2024-45025 |
| ubuntu | https://git.kernel.org/stable/c/dd72ae8b0fce9c0bbe9582b9b50820f0407f8d8a | https://ubuntu.com/security/CVE-2024-45025 |
| ubuntu | https://git.kernel.org/stable/c/c69d18f0ac7060de724511537810f10f29a27958 | https://ubuntu.com/security/CVE-2024-45025 |
| ubuntu | https://git.kernel.org/stable/c/9a2fa1472083580b6c66bdaf291f591e1170123a | https://ubuntu.com/security/CVE-2024-45025 |
| ubuntu | https://nvd.nist.gov/vuln/detail/CVE-2024-45025 | https://ubuntu.com/security/CVE-2024-45025 |
| ubuntu | https://launchpad.net/bugs/cve/CVE-2024-45025 | https://ubuntu.com/security/CVE-2024-45025 |
| ubuntu | https://security-tracker.debian.org/tracker/CVE-2024-45025 | https://ubuntu.com/security/CVE-2024-45025 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2024-45025 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://git.kernel.org/stable/c/5053581fe5dfb09b58c65dd8462bf5dea71f41ff |  | nvd |
|  |  | https://git.kernel.org/stable/c/8cad3b2b3ab81ca55f37405ffd1315bcc2948058 |  | nvd |
|  |  | https://git.kernel.org/stable/c/9a2fa1472083580b6c66bdaf291f591e1170123a |  | nvd |
|  |  | https://git.kernel.org/stable/c/c69d18f0ac7060de724511537810f10f29a27958 |  | nvd |
|  |  | https://git.kernel.org/stable/c/dd72ae8b0fce9c0bbe9582b9b50820f0407f8d8a |  | nvd |
|  |  | https://git.kernel.org/stable/c/e807487a1d5fd5d941f26578ae826ca815dbfcd6 |  | nvd |
|  |  | https://git.kernel.org/stable/c/ee501f827f3db02d4e599afbbc1a7f8b792d05d7 |  | nvd |
|  |  | https://git.kernel.org/stable/c/fe5bf14881701119aeeda7cf685f3c226c7380df |  | nvd |
| linux |  | https://git.kernel.org/linus/9a2fa1472083580b6c66bdaf291f591e1170123a | https://git.kernel.org/linus/1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 | ubuntu |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
          In the Linux kernel, the following vulnerability has been resolved:fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHAREcopy_fd_bitmaps(new, old, count) is expected to copy the firstcount/BITS_PER_LONG bits from old-&gt;full_fds_bits[] and fillthe rest with zeroes.  What it does is copying enough words(BITS_TO_LONGS(count/BITS_PER_LONG)), then memsets the rest.That works fine, *if* all bits past the cutoff point areclear.  Otherwise we are risking garbage from the last wordwe&#39;d copied.For most of the callers that is true - expand_fdtable() hascount equal to old-&gt;max_fds, so there&#39;s no open descriptorspast count, let alone fully occupied words in -&gt;open_fds[],which is what bits in -&gt;full_fds_bits[] correspond to.The other caller (dup_fd()) passes sane_fdtable_size(old_fdt, max_fds),which is the smallest multiple of BITS_PER_LONG that covers allopened descriptors below max_fds.  In the common case (copying onfork()) max_fds is ~0U, so all opened descriptors will be belowit and we are fine, by the same reasons why the call in expand_fdtable()is safe.Unfortunately, there is a case where max_fds is less than thatand where we might, indeed, end up with junk in -&gt;full_fds_bits[] -close_range(from, to, CLOSE_RANGE_UNSHARE) with* descriptor table being currently shared* &#39;to&#39; being above the current capacity of descriptor table* &#39;from&#39; being just under some chunk of opened descriptors.In that case we end up with observably wrong behaviour - e.g. spawna child with CLONE_FILES, get all descriptors in range 0..127 open,then close_range(64, ~0U, CLOSE_RANGE_UNSHARE) and watch dup(0) endingup with descriptor #128, despite #64 being observably not open.The minimally invasive fix would be to deal with that in dup_fd().If this proves to add measurable overhead, we can go that way, butlet&#39;s try to fix copy_fd_bitmaps() first.* new helper: bitmap_copy_and_expand(to, from, bits_to_copy, size).* make copy_fd_bitmaps() take the bitmap size in words, rather thanbits; it&#39;s &#39;count&#39; argument is always a multiple of BITS_PER_LONG,so we are not losing any information, and that way we can use thesame helper for all three bitmaps - compiler will see that countis a multiple of BITS_PER_LONG for the large ones, so it&#39;ll generateplain memcpy()+memset().Reproducer added to tools/testing/selftests/core/close_range_test.cThe Linux kernel CVE team has assigned CVE-2024-45025 to this issue.    
 openEuler评分：
  5.5
 Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP4(4.19.90):受影响
2.openEuler-22.03-LTS-SP1(5.10.0):受影响
3.openEuler-22.03-LTS-SP3(5.10.0):受影响
4.openEuler-22.03-LTS-SP4(5.10.0):受影响
5.openEuler-24.03-LTS(6.6.0):受影响
6.master(6.6.0):不受影响
7.openEuler-24.03-LTS-Next(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP4(4.19.90):否
2.openEuler-22.03-LTS-SP1(5.10.0):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.master(6.6.0):否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-22.03-LTS-SP4(5.10.0):否

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2024-2218

src-openEuler/kernel
Closed

Content Risk Flag

Comments (43)

src-openEuler/kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2024-45025

Comments (43)

Search

src-openEuler/kernel
Closed