CVE-2024-46749

一、漏洞信息
 漏洞编号：[CVE-2024-46749](https://nvd.nist.gov/vuln/detail/CVE-2024-46749)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.0,6.1.14,6.1.19,6.1.5,6.1.6,6.1.8,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：5.5 Medium
  Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:Bluetooth: btnxpuart: Fix Null pointer dereference in btnxpuart_flush()This adds a check before freeing the rx->skb in flush and closefunctions to handle the kernel crash seen while removing driver after FWdownload fails or before FW download completes.dmesg log:[   54.634586] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000080[   54.643398] Mem abort info:[   54.646204]   ESR = 0x0000000096000004[   54.649964]   EC = 0x25: DABT (current EL), IL = 32 bits[   54.655286]   SET = 0, FnV = 0[   54.658348]   EA = 0, S1PTW = 0[   54.661498]   FSC = 0x04: level 0 translation fault[   54.666391] Data abort info:[   54.669273]   ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000[   54.674768]   CM = 0, WnR = 0, TnD = 0, TagAccess = 0[   54.674771]   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0[   54.674775] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000048860000[   54.674780] [0000000000000080] pgd=0000000000000000, p4d=0000000000000000[   54.703880] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP[   54.710152] Modules linked in: btnxpuart(-) overlay fsl_jr_uio caam_jr caamkeyblob_desc caamhash_desc caamalg_desc crypto_engine authenc libdes crct10dif_ce polyval_ce polyval_generic snd_soc_imx_spdif snd_soc_imx_card snd_soc_ak5558 snd_soc_ak4458 caam secvio error snd_soc_fsl_micfil snd_soc_fsl_spdif snd_soc_fsl_sai snd_soc_fsl_utils imx_pcm_dma gpio_ir_recv rc_core sch_fq_codel fuse[   54.744357] CPU: 3 PID: 72 Comm: kworker/u9:0 Not tainted 6.6.3-otbr-g128004619037 #2[   54.744364] Hardware name: FSL i.MX8MM EVK board (DT)[   54.744368] Workqueue: hci0 hci_power_on[   54.757244] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)[   54.757249] pc : kfree_skb_reason+0x18/0xb0[   54.772299] lr : btnxpuart_flush+0x40/0x58 [btnxpuart][   54.782921] sp : ffff8000805ebca0[   54.782923] x29: ffff8000805ebca0 x28: ffffa5c6cf1869c0 x27: ffffa5c6cf186000[   54.782931] x26: ffff377b84852400 x25: ffff377b848523c0 x24: ffff377b845e7230[   54.782938] x23: ffffa5c6ce8dbe08 x22: ffffa5c6ceb65410 x21: 00000000ffffff92[   54.782945] x20: ffffa5c6ce8dbe98 x19: ffffffffffffffac x18: ffffffffffffffff[   54.807651] x17: 0000000000000000 x16: ffffa5c6ce2824ec x15: ffff8001005eb857[   54.821917] x14: 0000000000000000 x13: ffffa5c6cf1a02e0 x12: 0000000000000642[   54.821924] x11: 0000000000000040 x10: ffffa5c6cf19d690 x9 : ffffa5c6cf19d688[   54.821931] x8 : ffff377b86000028 x7 : 0000000000000000 x6 : 0000000000000000[   54.821938] x5 : ffff377b86000000 x4 : 0000000000000000 x3 : 0000000000000000[   54.843331] x2 : 0000000000000000 x1 : 0000000000000002 x0 : ffffffffffffffac[   54.857599] Call trace:[   54.857601]  kfree_skb_reason+0x18/0xb0[   54.863878]  btnxpuart_flush+0x40/0x58 [btnxpuart][   54.863888]  hci_dev_open_sync+0x3a8/0xa04[   54.872773]  hci_power_on+0x54/0x2e4[   54.881832]  process_one_work+0x138/0x260[   54.881842]  worker_thread+0x32c/0x438[   54.881847]  kthread+0x118/0x11c[   54.881853]  ret_from_fork+0x10/0x20[   54.896406] Code: a9be7bfd 910003fd f9000bf3 aa0003f3 (b940d400)[   54.896410] ---[ end trace 0000000000000000 ]---
 漏洞公开时间：2024-09-18 16:15:03
 漏洞创建时间：2024-09-18 17:15:34
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2024-46749
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/013dae4735d2010544d1f2121bdeb8e6c9ea171e |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/056e0cd381d59a9124b7c43dd715e15f56a11635 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/c68bbf5e334b35b36ac5b9f0419f1f93f796bad1 |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-46749 | https://bugzilla.suse.com/show_bug.cgi?id=1230780 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2024-46749 | https://bugzilla.suse.com/show_bug.cgi?id=1230780 |
| suse_bugzilla | https://git.kernel.org/stable/c/013dae4735d2010544d1f2121bdeb8e6c9ea171e | https://bugzilla.suse.com/show_bug.cgi?id=1230780 |
| suse_bugzilla | https://git.kernel.org/stable/c/056e0cd381d59a9124b7c43dd715e15f56a11635 | https://bugzilla.suse.com/show_bug.cgi?id=1230780 |
| suse_bugzilla | https://git.kernel.org/stable/c/c68bbf5e334b35b36ac5b9f0419f1f93f796bad1 | https://bugzilla.suse.com/show_bug.cgi?id=1230780 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2024/CVE-2024-46749.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1230780 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2313097 | https://bugzilla.suse.com/show_bug.cgi?id=1230780 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2024-46749 |
| anolis |  | https://anas.openanolis.cn/cves/detail/CVE-2024-46749 |
| mageia |  | http://advisories.mageia.org/MGASA-2024-0316.html |
| amazon_linux_explore | https://access.redhat.com/security/cve/CVE-2024-46749 | https://explore.alas.aws.amazon.com/CVE-2024-46749.html |
| amazon_linux_explore | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-46749 | https://explore.alas.aws.amazon.com/CVE-2024-46749.html |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://git.kernel.org/stable/c/013dae4735d2010544d1f2121bdeb8e6c9ea171e |  | nvd |
|  |  | https://git.kernel.org/stable/c/056e0cd381d59a9124b7c43dd715e15f56a11635 |  | nvd |
|  |  | https://git.kernel.org/stable/c/c68bbf5e334b35b36ac5b9f0419f1f93f796bad1 |  | nvd |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:Bluetooth: btnxpuart: Fix Null pointer dereference in btnxpuart_flush()This adds a check before freeing the rx->skb in flush and closefunctions to handle the kernel crash seen while removing driver after FWdownload fails or before FW download completes.dmesg log:[   54.634586] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000080[   54.643398] Mem abort info:[   54.646204]   ESR = 0x0000000096000004[   54.649964]   EC = 0x25: DABT (current EL), IL = 32 bits[   54.655286]   SET = 0, FnV = 0[   54.658348]   EA = 0, S1PTW = 0[   54.661498]   FSC = 0x04: level 0 translation fault[   54.666391] Data abort info:[   54.669273]   ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000[   54.674768]   CM = 0, WnR = 0, TnD = 0, TagAccess = 0[   54.674771]   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0[   54.674775] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000048860000[   54.674780] [0000000000000080] pgd=0000000000000000, p4d=0000000000000000[   54.703880] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP[   54.710152] Modules linked in: btnxpuart(-) overlay fsl_jr_uio caam_jr caamkeyblob_desc caamhash_desc caamalg_desc crypto_engine authenc libdes crct10dif_ce polyval_ce polyval_generic snd_soc_imx_spdif snd_soc_imx_card snd_soc_ak5558 snd_soc_ak4458 caam secvio error snd_soc_fsl_micfil snd_soc_fsl_spdif snd_soc_fsl_sai snd_soc_fsl_utils imx_pcm_dma gpio_ir_recv rc_core sch_fq_codel fuse[   54.744357] CPU: 3 PID: 72 Comm: kworker/u9:0 Not tainted 6.6.3-otbr-g128004619037 #2[   54.744364] Hardware name: FSL i.MX8MM EVK board (DT)[   54.744368] Workqueue: hci0 hci_power_on[   54.757244] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)[   54.757249] pc : kfree_skb_reason+0x18/0xb0[   54.772299] lr : btnxpuart_flush+0x40/0x58 [btnxpuart][   54.782921] sp : ffff8000805ebca0[   54.782923] x29: ffff8000805ebca0 x28: ffffa5c6cf1869c0 x27: ffffa5c6cf186000[   54.782931] x26: ffff377b84852400 x25: ffff377b848523c0 x24: ffff377b845e7230[   54.782938] x23: ffffa5c6ce8dbe08 x22: ffffa5c6ceb65410 x21: 00000000ffffff92[   54.782945] x20: ffffa5c6ce8dbe98 x19: ffffffffffffffac x18: ffffffffffffffff[   54.807651] x17: 0000000000000000 x16: ffffa5c6ce2824ec x15: ffff8001005eb857[   54.821917] x14: 0000000000000000 x13: ffffa5c6cf1a02e0 x12: 0000000000000642[   54.821924] x11: 0000000000000040 x10: ffffa5c6cf19d690 x9 : ffffa5c6cf19d688[   54.821931] x8 : ffff377b86000028 x7 : 0000000000000000 x6 : 0000000000000000[   54.821938] x5 : ffff377b86000000 x4 : 0000000000000000 x3 : 0000000000000000[   54.843331] x2 : 0000000000000000 x1 : 0000000000000002 x0 : ffffffffffffffac[   54.857599] Call trace:[   54.857601]  kfree_skb_reason+0x18/0xb0[   54.863878]  btnxpuart_flush+0x40/0x58 [btnxpuart][   54.863888]  hci_dev_open_sync+0x3a8/0xa04[   54.872773]  hci_power_on+0x54/0x2e4[   54.881832]  process_one_work+0x138/0x260[   54.881842]  worker_thread+0x32c/0x438[   54.881847]  kthread+0x118/0x11c[   54.881853]  ret_from_fork+0x10/0x20[   54.896406] Code: a9be7bfd 910003fd f9000bf3 aa0003f3 (b940d400)[   54.896410] ---[ end trace 0000000000000000 ]---
 openEuler评分：
  5.5
 Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-24.03-LTS(6.6.0):受影响
2.openEuler-20.03-LTS-SP4(4.19.90):不受影响
3.openEuler-22.03-LTS-SP1(5.10.0):不受影响
4.openEuler-22.03-LTS-SP3(5.10.0):不受影响
5.openEuler-22.03-LTS-SP4(5.10.0):不受影响
6.master(6.6.0):不受影响
7.openEuler-24.03-LTS-Next(6.6.0):不受影响
8.openEuler-24.03-LTS-SP1:不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP4(4.19.90):否
2.openEuler-22.03-LTS-SP1(5.10.0):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.master(6.6.0):否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-22.03-LTS-SP4(5.10.0):否
8.openEuler-24.03-LTS-SP1:否

原因说明：
  1.openEuler-24.03-LTS(6.6.0):正常修复
2.openEuler-20.03-LTS-SP4(4.19.90):不受影响-漏洞代码不存在
3.openEuler-22.03-LTS-SP1(5.10.0):不受影响-漏洞代码不存在
4.openEuler-22.03-LTS-SP3(5.10.0):不受影响-漏洞代码不存在
5.openEuler-22.03-LTS-SP4(5.10.0):不受影响-漏洞代码不存在
6.master(6.6.0):不受影响-漏洞代码不存在
7.openEuler-24.03-LTS-Next(6.6.0):不受影响-漏洞代码不存在
8.openEuler-24.03-LTS-SP1:不受影响-漏洞代码不存在

src-openEuler/kernel

Content Risk Flag

Comments (18)

src-openEuler/kernel .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2024-46749

Comments (18)

Search

src-openEuler/kernel