CVE-2024-46680

一、漏洞信息
 漏洞编号：[CVE-2024-46680](https://nvd.nist.gov/vuln/detail/CVE-2024-46680)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.0,6.1.14,6.1.19,6.1.5,6.1.6,6.1.8,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：5.5 Medium
  Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:Bluetooth: btnxpuart: Fix random crash seen while removing driverThis fixes the random kernel crash seen while removing the driver, whenrunning the load/unload test over multiple iterations.1) modprobe btnxpuart2) hciconfig hci0 reset3) hciconfig (check hci0 interface up with valid BD address)4) modprobe -r btnxpuartRepeat steps 1 to 4The ps_wakeup() call in btnxpuart_close() schedules the psdata->work(),which gets scheduled after module is removed, causing a kernel crash.This hidden issue got highlighted after enabling Power Save by defaultin 4183a7be7700 (Bluetooth: btnxpuart: Enable Power Save feature onstartup)The new ps_cleanup() deasserts UART break immediately while closingserdev device, cancels any scheduled ps_work and destroys the ps_lockmutex.[   85.884604] Unable to handle kernel paging request at virtual address ffffd4a61638f258[   85.884624] Mem abort info:[   85.884625]   ESR = 0x0000000086000007[   85.884628]   EC = 0x21: IABT (current EL), IL = 32 bits[   85.884633]   SET = 0, FnV = 0[   85.884636]   EA = 0, S1PTW = 0[   85.884638]   FSC = 0x07: level 3 translation fault[   85.884642] swapper pgtable: 4k pages, 48-bit VAs, pgdp=0000000041dd0000[   85.884646] [ffffd4a61638f258] pgd=1000000095fff003, p4d=1000000095fff003, pud=100000004823d003, pmd=100000004823e003, pte=0000000000000000[   85.884662] Internal error: Oops: 0000000086000007 [#1] PREEMPT SMP[   85.890932] Modules linked in: algif_hash algif_skcipher af_alg overlay fsl_jr_uio caam_jr caamkeyblob_desc caamhash_desc caamalg_desc crypto_engine authenc libdes crct10dif_ce polyval_ce polyval_generic snd_soc_imx_spdif snd_soc_imx_card snd_soc_ak5558 snd_soc_ak4458 caam secvio error snd_soc_fsl_spdif snd_soc_fsl_micfil snd_soc_fsl_sai snd_soc_fsl_utils gpio_ir_recv rc_core fuse [last unloaded: btnxpuart(O)][   85.927297] CPU: 1 PID: 67 Comm: kworker/1:3 Tainted: G           O       6.1.36+g937b1be4345a #1[   85.936176] Hardware name: FSL i.MX8MM EVK board (DT)[   85.936182] Workqueue: events 0xffffd4a61638f380[   85.936198] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)[   85.952817] pc : 0xffffd4a61638f258[   85.952823] lr : 0xffffd4a61638f258[   85.952827] sp : ffff8000084fbd70[   85.952829] x29: ffff8000084fbd70 x28: 0000000000000000 x27: 0000000000000000[   85.963112] x26: ffffd4a69133f000 x25: ffff4bf1c8540990 x24: ffff4bf215b87305[   85.963119] x23: ffff4bf215b87300 x22: ffff4bf1c85409d0 x21: ffff4bf1c8540970[   85.977382] x20: 0000000000000000 x19: ffff4bf1c8540880 x18: 0000000000000000[   85.977391] x17: 0000000000000000 x16: 0000000000000133 x15: 0000ffffe2217090[   85.977399] x14: 0000000000000001 x13: 0000000000000133 x12: 0000000000000139[   85.977407] x11: 0000000000000001 x10: 0000000000000a60 x9 : ffff8000084fbc50[   85.977417] x8 : ffff4bf215b7d000 x7 : ffff4bf215b83b40 x6 : 00000000000003e8[   85.977424] x5 : 00000000410fd030 x4 : 0000000000000000 x3 : 0000000000000000[   85.977432] x2 : 0000000000000000 x1 : ffff4bf1c4265880 x0 : 0000000000000000[   85.977443] Call trace:[   85.977446]  0xffffd4a61638f258[   85.977451]  0xffffd4a61638f3e8[   85.977455]  process_one_work+0x1d4/0x330[   85.977464]  worker_thread+0x6c/0x430[   85.977471]  kthread+0x108/0x10c[   85.977476]  ret_from_fork+0x10/0x20[   85.977488] Code: bad PC value[   85.977491] ---[ end trace 0000000000000000 ]---Preset since v6.9.11
 漏洞公开时间：2024-09-13 14:15:12
 漏洞创建时间：2024-09-13 14:30:36
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2024-46680
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/29a1d9971e38f92c84b363ff50379dd434ddfe1c |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/35237475384ab3622f63c3c09bdf6af6dacfe9c3 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/662a55986b88807da4d112d838c8aaa05810e938 |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-46680 | https://bugzilla.suse.com/show_bug.cgi?id=1230557 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2024/CVE-2024-46680.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1230557 |
| suse_bugzilla | https://git.kernel.org/stable/c/662a55986b88807da4d112d838c8aaa05810e938 | https://bugzilla.suse.com/show_bug.cgi?id=1230557 |
| suse_bugzilla | https://git.kernel.org/stable/c/29a1d9971e38f92c84b363ff50379dd434ddfe1c | https://bugzilla.suse.com/show_bug.cgi?id=1230557 |
| suse_bugzilla | https://git.kernel.org/stable/c/35237475384ab3622f63c3c09bdf6af6dacfe9c3 | https://bugzilla.suse.com/show_bug.cgi?id=1230557 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2024-46680 | https://bugzilla.suse.com/show_bug.cgi?id=1230557 |
| redhat_bugzilla | https://lore.kernel.org/linux-cve-announce/2024091336-CVE-2024-46680-f40d@gregkh/T | https://bugzilla.redhat.com/show_bug.cgi?id=2312068 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2024-46680 |
| anolis |  | https://anas.openanolis.cn/cves/detail/CVE-2024-46680 |
| cve_search |  | https://git.kernel.org/stable/c/662a55986b88807da4d112d838c8aaa05810e938 |
| cve_search |  | https://git.kernel.org/stable/c/29a1d9971e38f92c84b363ff50379dd434ddfe1c |
| cve_search |  | https://git.kernel.org/stable/c/35237475384ab3622f63c3c09bdf6af6dacfe9c3 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://git.kernel.org/stable/c/29a1d9971e38f92c84b363ff50379dd434ddfe1c |  | nvd |
|  |  | https://git.kernel.org/stable/c/35237475384ab3622f63c3c09bdf6af6dacfe9c3 |  | nvd |
|  |  | https://git.kernel.org/stable/c/662a55986b88807da4d112d838c8aaa05810e938 |  | nvd |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:Bluetooth: btnxpuart: Fix random crash seen while removing driverThis fixes the random kernel crash seen while removing the driver, whenrunning the load/unload test over multiple iterations.1) modprobe btnxpuart2) hciconfig hci0 reset3) hciconfig (check hci0 interface up with valid BD address)4) modprobe -r btnxpuartRepeat steps 1 to 4The ps_wakeup() call in btnxpuart_close() schedules the psdata->work(),which gets scheduled after module is removed, causing a kernel crash.This hidden issue got highlighted after enabling Power Save by defaultin 4183a7be7700 (Bluetooth: btnxpuart: Enable Power Save feature onstartup)The new ps_cleanup() deasserts UART break immediately while closingserdev device, cancels any scheduled ps_work and destroys the ps_lockmutex.[   85.884604] Unable to handle kernel paging request at virtual address ffffd4a61638f258[   85.884624] Mem abort info:[   85.884625]   ESR = 0x0000000086000007[   85.884628]   EC = 0x21: IABT (current EL), IL = 32 bits[   85.884633]   SET = 0, FnV = 0[   85.884636]   EA = 0, S1PTW = 0[   85.884638]   FSC = 0x07: level 3 translation fault[   85.884642] swapper pgtable: 4k pages, 48-bit VAs, pgdp=0000000041dd0000[   85.884646] [ffffd4a61638f258] pgd=1000000095fff003, p4d=1000000095fff003, pud=100000004823d003, pmd=100000004823e003, pte=0000000000000000[   85.884662] Internal error: Oops: 0000000086000007 [#1] PREEMPT SMP[   85.890932] Modules linked in: algif_hash algif_skcipher af_alg overlay fsl_jr_uio caam_jr caamkeyblob_desc caamhash_desc caamalg_desc crypto_engine authenc libdes crct10dif_ce polyval_ce polyval_generic snd_soc_imx_spdif snd_soc_imx_card snd_soc_ak5558 snd_soc_ak4458 caam secvio error snd_soc_fsl_spdif snd_soc_fsl_micfil snd_soc_fsl_sai snd_soc_fsl_utils gpio_ir_recv rc_core fuse [last unloaded: btnxpuart(O)][   85.927297] CPU: 1 PID: 67 Comm: kworker/1:3 Tainted: G           O       6.1.36+g937b1be4345a #1[   85.936176] Hardware name: FSL i.MX8MM EVK board (DT)[   85.936182] Workqueue: events 0xffffd4a61638f380[   85.936198] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)[   85.952817] pc : 0xffffd4a61638f258[   85.952823] lr : 0xffffd4a61638f258[   85.952827] sp : ffff8000084fbd70[   85.952829] x29: ffff8000084fbd70 x28: 0000000000000000 x27: 0000000000000000[   85.963112] x26: ffffd4a69133f000 x25: ffff4bf1c8540990 x24: ffff4bf215b87305[   85.963119] x23: ffff4bf215b87300 x22: ffff4bf1c85409d0 x21: ffff4bf1c8540970[   85.977382] x20: 0000000000000000 x19: ffff4bf1c8540880 x18: 0000000000000000[   85.977391] x17: 0000000000000000 x16: 0000000000000133 x15: 0000ffffe2217090[   85.977399] x14: 0000000000000001 x13: 0000000000000133 x12: 0000000000000139[   85.977407] x11: 0000000000000001 x10: 0000000000000a60 x9 : ffff8000084fbc50[   85.977417] x8 : ffff4bf215b7d000 x7 : ffff4bf215b83b40 x6 : 00000000000003e8[   85.977424] x5 : 00000000410fd030 x4 : 0000000000000000 x3 : 0000000000000000[   85.977432] x2 : 0000000000000000 x1 : ffff4bf1c4265880 x0 : 0000000000000000[   85.977443] Call trace:[   85.977446]  0xffffd4a61638f258[   85.977451]  0xffffd4a61638f3e8[   85.977455]  process_one_work+0x1d4/0x330[   85.977464]  worker_thread+0x6c/0x430[   85.977471]  kthread+0x108/0x10c[   85.977476]  ret_from_fork+0x10/0x20[   85.977488] Code: bad PC value[   85.977491] ---[ end trace 0000000000000000 ]---Preset since v6.9.11
 openEuler评分：
  5.5
 Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-24.03-LTS(6.6.0):受影响
2.openEuler-20.03-LTS-SP4(4.19.90):不受影响
3.openEuler-22.03-LTS-SP3(5.10.0):不受影响
4.openEuler-22.03-LTS-SP4(5.10.0):不受影响
5.master(6.6.0):不受影响
6.openEuler-24.03-LTS-Next(6.6.0):不受影响
7.openEuler-24.03-LTS-SP1(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP4(4.19.90):否
2.openEuler-22.03-LTS-SP1(5.10.0):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.master(6.6.0):否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-22.03-LTS-SP4(5.10.0):否
8.openEuler-24.03-LTS-SP1(6.6.0):否

原因说明：
  1.openEuler-24.03-LTS(6.6.0):正常修复
2.master(6.6.0):不受影响-漏洞代码不能被攻击者触发
3.openEuler-24.03-LTS-Next(6.6.0):不受影响-漏洞代码不能被攻击者触发
4.openEuler-20.03-LTS-SP4(4.19.90):不受影响-漏洞代码不存在
5.openEuler-22.03-LTS-SP3(5.10.0):不受影响-漏洞代码不存在
6.openEuler-22.03-LTS-SP4(5.10.0):不受影响-漏洞代码不存在
7.openEuler-24.03-LTS-SP1(6.6.0):不受影响-漏洞代码不存在

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2025-1097

src-openEuler / kernel
Closed

Content Risk Flag

Comments (23)

src-openEuler / kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2024-46680

Comments (23)

Search

src-openEuler / kernel
Closed