CVE-2024-46782

一、漏洞信息
 漏洞编号：[CVE-2024-46782](https://nvd.nist.gov/vuln/detail/CVE-2024-46782)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.0,6.1.14,6.1.19,6.1.5,6.1.6,6.1.8,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：7.8 High
  Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:ila: call nf_unregister_net_hooks() soonersyzbot found an use-after-free Read in ila_nf_input [1]Issue here is that ila_xlat_exit_net() frees the rhashtable,then call nf_unregister_net_hooks().It should be done in the reverse way, with a synchronize_rcu().This is a good match for a pre_exit() method.[1] BUG: KASAN: use-after-free in rht_key_hashfn include/linux/rhashtable.h:159 [inline] BUG: KASAN: use-after-free in __rhashtable_lookup include/linux/rhashtable.h:604 [inline] BUG: KASAN: use-after-free in rhashtable_lookup include/linux/rhashtable.h:646 [inline] BUG: KASAN: use-after-free in rhashtable_lookup_fast+0x77a/0x9b0 include/linux/rhashtable.h:672Read of size 4 at addr ffff888064620008 by task ksoftirqd/0/16CPU: 0 UID: 0 PID: 16 Comm: ksoftirqd/0 Not tainted 6.11.0-rc4-syzkaller-00238-g2ad6d23f465a #0Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024Call Trace: <TASK>  __dump_stack lib/dump_stack.c:93 [inline]  dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119  print_address_description mm/kasan/report.c:377 [inline]  print_report+0x169/0x550 mm/kasan/report.c:488  kasan_report+0x143/0x180 mm/kasan/report.c:601  rht_key_hashfn include/linux/rhashtable.h:159 [inline]  __rhashtable_lookup include/linux/rhashtable.h:604 [inline]  rhashtable_lookup include/linux/rhashtable.h:646 [inline]  rhashtable_lookup_fast+0x77a/0x9b0 include/linux/rhashtable.h:672  ila_lookup_wildcards net/ipv6/ila/ila_xlat.c:132 [inline]  ila_xlat_addr net/ipv6/ila/ila_xlat.c:652 [inline]  ila_nf_input+0x1fe/0x3c0 net/ipv6/ila/ila_xlat.c:190  nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline]  nf_hook_slow+0xc3/0x220 net/netfilter/core.c:626  nf_hook include/linux/netfilter.h:269 [inline]  NF_HOOK+0x29e/0x450 include/linux/netfilter.h:312  __netif_receive_skb_one_core net/core/dev.c:5661 [inline]  __netif_receive_skb+0x1ea/0x650 net/core/dev.c:5775  process_backlog+0x662/0x15b0 net/core/dev.c:6108  __napi_poll+0xcb/0x490 net/core/dev.c:6772  napi_poll net/core/dev.c:6841 [inline]  net_rx_action+0x89b/0x1240 net/core/dev.c:6963  handle_softirqs+0x2c4/0x970 kernel/softirq.c:554  run_ksoftirqd+0xca/0x130 kernel/softirq.c:928  smpboot_thread_fn+0x544/0xa30 kernel/smpboot.c:164  kthread+0x2f0/0x390 kernel/kthread.c:389  ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK>The buggy address belongs to the physical page:page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x64620flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)page_type: 0xbfffffff(buddy)raw: 00fff00000000000 ffffea0000959608 ffffea00019d9408 0000000000000000raw: 0000000000000000 0000000000000003 00000000bfffffff 0000000000000000page dumped because: kasan: bad access detectedpage_owner tracks the page as freedpage last allocated via order 3, migratetype Unmovable, gfp_mask 0x52dc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_ZERO), pid 5242, tgid 5242 (syz-executor), ts 73611328570, free_ts 618981657187  set_page_owner include/linux/page_owner.h:32 [inline]  post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1493  prep_new_page mm/page_alloc.c:1501 [inline]  get_page_from_freelist+0x2e4c/0x2f10 mm/page_alloc.c:3439  __alloc_pages_noprof+0x256/0x6c0 mm/page_alloc.c:4695  __alloc_pages_node_noprof include/linux/gfp.h:269 [inline]  alloc_pages_node_noprof include/linux/gfp.h:296 [inline]  ___kmalloc_large_node+0x8b/0x1d0 mm/slub.c:4103  __kmalloc_large_node_noprof+0x1a/0x80 mm/slub.c:4130  __do_kmalloc_node mm/slub.c:4146 [inline]  __kmalloc_node_noprof+0x2d2/0x440 mm/slub.c:4164  __kvmalloc_node_noprof+0x72/0x190 mm/util.c:650  bucket_table_alloc lib/rhashtable.c:186 [inline]  rhashtable_init_noprof+0x534/0xa60 lib/rhashtable.c:1071  ila_xlat_init_net+0xa0/0x110 net/ipv6/ila/ila_xlat.c:613  ops_ini---truncated---
 漏洞公开时间：2024-09-18 16:15:05
 漏洞创建时间：2024-10-02 02:17:47
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2024-46782
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/031ae72825cef43e4650140b800ad58bf7a6a466 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/18a5a16940464b301ea91bf5da3a324aedb347b2 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/43d34110882b97ba1ec66cc8234b18983efb9abf |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/47abd8adddbc0aecb8f231269ef659148d5dabe4 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/925c18a7cff93d8a4320d652351294ff7d0ac93c |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/93ee345ba349922834e6a9d1dadabaedcc12dce6 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/bda4d84ac0d5421b346faee720011f58bdb99673 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/dcaf4e2216824839d26727a15b638c6a677bd9fc |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-46782 | https://bugzilla.suse.com/show_bug.cgi?id=1230769 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2024-46782 | https://bugzilla.suse.com/show_bug.cgi?id=1230769 |
| suse_bugzilla | https://git.kernel.org/stable/c/031ae72825cef43e4650140b800ad58bf7a6a466 | https://bugzilla.suse.com/show_bug.cgi?id=1230769 |
| suse_bugzilla | https://git.kernel.org/stable/c/18a5a16940464b301ea91bf5da3a324aedb347b2 | https://bugzilla.suse.com/show_bug.cgi?id=1230769 |
| suse_bugzilla | https://git.kernel.org/stable/c/43d34110882b97ba1ec66cc8234b18983efb9abf | https://bugzilla.suse.com/show_bug.cgi?id=1230769 |
| suse_bugzilla | https://git.kernel.org/stable/c/47abd8adddbc0aecb8f231269ef659148d5dabe4 | https://bugzilla.suse.com/show_bug.cgi?id=1230769 |
| suse_bugzilla | https://git.kernel.org/stable/c/925c18a7cff93d8a4320d652351294ff7d0ac93c | https://bugzilla.suse.com/show_bug.cgi?id=1230769 |
| suse_bugzilla | https://git.kernel.org/stable/c/93ee345ba349922834e6a9d1dadabaedcc12dce6 | https://bugzilla.suse.com/show_bug.cgi?id=1230769 |
| suse_bugzilla | https://git.kernel.org/stable/c/bda4d84ac0d5421b346faee720011f58bdb99673 | https://bugzilla.suse.com/show_bug.cgi?id=1230769 |
| suse_bugzilla | https://git.kernel.org/stable/c/dcaf4e2216824839d26727a15b638c6a677bd9fc | https://bugzilla.suse.com/show_bug.cgi?id=1230769 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2024/CVE-2024-46782.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1230769 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2313129 | https://bugzilla.suse.com/show_bug.cgi?id=1230769 |
| redhat_bugzilla | https://lore.kernel.org/linux-cve-announce/2024091850-CVE-2024-46782-00ff@gregkh/T | https://bugzilla.redhat.com/show_bug.cgi?id=2313129 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2024-46782 |
| anolis |  | https://anas.openanolis.cn/cves/detail/CVE-2024-46782 |
| mageia |  | http://advisories.mageia.org/MGASA-2024-0316.html |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://git.kernel.org/stable/c/031ae72825cef43e4650140b800ad58bf7a6a466 |  | nvd |
|  |  | https://git.kernel.org/stable/c/18a5a16940464b301ea91bf5da3a324aedb347b2 |  | nvd |
|  |  | https://git.kernel.org/stable/c/43d34110882b97ba1ec66cc8234b18983efb9abf |  | nvd |
|  |  | https://git.kernel.org/stable/c/47abd8adddbc0aecb8f231269ef659148d5dabe4 |  | nvd |
|  |  | https://git.kernel.org/stable/c/925c18a7cff93d8a4320d652351294ff7d0ac93c |  | nvd |
|  |  | https://git.kernel.org/stable/c/93ee345ba349922834e6a9d1dadabaedcc12dce6 |  | nvd |
|  |  | https://git.kernel.org/stable/c/bda4d84ac0d5421b346faee720011f58bdb99673 |  | nvd |
|  |  | https://git.kernel.org/stable/c/dcaf4e2216824839d26727a15b638c6a677bd9fc |  | nvd |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:ila: call nf_unregister_net_hooks() soonersyzbot found an use-after-free Read in ila_nf_input [1]Issue here is that ila_xlat_exit_net() frees the rhashtable,then call nf_unregister_net_hooks().It should be done in the reverse way, with a synchronize_rcu().This is a good match for a pre_exit() method.[1] BUG: KASAN: use-after-free in rht_key_hashfn include/linux/rhashtable.h:159 [inline] BUG: KASAN: use-after-free in __rhashtable_lookup include/linux/rhashtable.h:604 [inline] BUG: KASAN: use-after-free in rhashtable_lookup include/linux/rhashtable.h:646 [inline] BUG: KASAN: use-after-free in rhashtable_lookup_fast+0x77a/0x9b0 include/linux/rhashtable.h:672Read of size 4 at addr ffff888064620008 by task ksoftirqd/0/16CPU: 0 UID: 0 PID: 16 Comm: ksoftirqd/0 Not tainted 6.11.0-rc4-syzkaller-00238-g2ad6d23f465a #0Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024Call Trace: <TASK>  __dump_stack lib/dump_stack.c:93 [inline]  dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119  print_address_description mm/kasan/report.c:377 [inline]  print_report+0x169/0x550 mm/kasan/report.c:488  kasan_report+0x143/0x180 mm/kasan/report.c:601  rht_key_hashfn include/linux/rhashtable.h:159 [inline]  __rhashtable_lookup include/linux/rhashtable.h:604 [inline]  rhashtable_lookup include/linux/rhashtable.h:646 [inline]  rhashtable_lookup_fast+0x77a/0x9b0 include/linux/rhashtable.h:672  ila_lookup_wildcards net/ipv6/ila/ila_xlat.c:132 [inline]  ila_xlat_addr net/ipv6/ila/ila_xlat.c:652 [inline]  ila_nf_input+0x1fe/0x3c0 net/ipv6/ila/ila_xlat.c:190  nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline]  nf_hook_slow+0xc3/0x220 net/netfilter/core.c:626  nf_hook include/linux/netfilter.h:269 [inline]  NF_HOOK+0x29e/0x450 include/linux/netfilter.h:312  __netif_receive_skb_one_core net/core/dev.c:5661 [inline]  __netif_receive_skb+0x1ea/0x650 net/core/dev.c:5775  process_backlog+0x662/0x15b0 net/core/dev.c:6108  __napi_poll+0xcb/0x490 net/core/dev.c:6772  napi_poll net/core/dev.c:6841 [inline]  net_rx_action+0x89b/0x1240 net/core/dev.c:6963  handle_softirqs+0x2c4/0x970 kernel/softirq.c:554  run_ksoftirqd+0xca/0x130 kernel/softirq.c:928  smpboot_thread_fn+0x544/0xa30 kernel/smpboot.c:164  kthread+0x2f0/0x390 kernel/kthread.c:389  ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK>The buggy address belongs to the physical page:page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x64620flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)page_type: 0xbfffffff(buddy)raw: 00fff00000000000 ffffea0000959608 ffffea00019d9408 0000000000000000raw: 0000000000000000 0000000000000003 00000000bfffffff 0000000000000000page dumped because: kasan: bad access detectedpage_owner tracks the page as freedpage last allocated via order 3, migratetype Unmovable, gfp_mask 0x52dc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_ZERO), pid 5242, tgid 5242 (syz-executor), ts 73611328570, free_ts 618981657187  set_page_owner include/linux/page_owner.h:32 [inline]  post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1493  prep_new_page mm/page_alloc.c:1501 [inline]  get_page_from_freelist+0x2e4c/0x2f10 mm/page_alloc.c:3439  __alloc_pages_noprof+0x256/0x6c0 mm/page_alloc.c:4695  __alloc_pages_node_noprof include/linux/gfp.h:269 [inline]  alloc_pages_node_noprof include/linux/gfp.h:296 [inline]  ___kmalloc_large_node+0x8b/0x1d0 mm/slub.c:4103  __kmalloc_large_node_noprof+0x1a/0x80 mm/slub.c:4130  __do_kmalloc_node mm/slub.c:4146 [inline]  __kmalloc_node_noprof+0x2d2/0x440 mm/slub.c:4164  __kvmalloc_node_noprof+0x72/0x190 mm/util.c:650  bucket_table_alloc lib/rhashtable.c:186 [inline]  rhashtable_init_noprof+0x534/0xa60 lib/rhashtable.c:1071  ila_xlat_init_net+0xa0/0x110 net/ipv6/ila/ila_xlat.c:613  ops_ini---truncated---
 openEuler评分：
  7.8
 Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP4(4.19.90):受影响
2.openEuler-22.03-LTS-SP1(5.10.0):受影响
3.openEuler-22.03-LTS-SP3(5.10.0):受影响
4.openEuler-22.03-LTS-SP4(5.10.0):受影响
5.openEuler-24.03-LTS(6.6.0):受影响
6.master(6.6.0):不受影响
7.openEuler-24.03-LTS-Next(6.6.0):不受影响
8.openEuler-24.03-LTS-SP1(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP4(4.19.90):否
2.openEuler-22.03-LTS-SP1(5.10.0):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.master(6.6.0):否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-22.03-LTS-SP4(5.10.0):否
8.openEuler-24.03-LTS-SP1(6.6.0):否

原因说明：
  1.openEuler-24.03-LTS(6.6.0):正常修复
2.openEuler-22.03-LTS-SP1(5.10.0):暂不修复-漏洞仍在分析中
3.openEuler-22.03-LTS-SP3(5.10.0):暂不修复-漏洞仍在分析中
4.openEuler-22.03-LTS-SP4(5.10.0):暂不修复-漏洞仍在分析中
5.openEuler-20.03-LTS-SP4(4.19.90):不修复-超出修复范围
6.master(6.6.0):不受影响-漏洞代码不存在
7.openEuler-24.03-LTS-Next(6.6.0):不受影响-漏洞代码不存在
8.openEuler-24.03-LTS-SP1(6.6.0):不受影响-漏洞代码不存在

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2025-1162

src-openEuler/kernel
Closed

Content Risk Flag

Comments (24)

src-openEuler/kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2024-46782

Comments (24)

Search

src-openEuler/kernel
Closed