CVE-2024-47702

一、漏洞信息
 漏洞编号：[CVE-2024-47702](https://nvd.nist.gov/vuln/detail/CVE-2024-47702)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.0,6.1.14,6.1.19,6.1.5,6.1.6,6.1.8,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：5.5 Medium
  Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:bpf: Fail verification for sign-extension of packet data/data_end/data_metasyzbot reported a kernel crash due to  commit 1f1e864b6555 ( bpf: Handle sign-extenstin ctx member accesses ).The reason is due to sign-extension of 32-bit load forpacket data/data_end/data_meta uapi field.The original code looks like:        r2 = *(s32 *)(r1 + 76) /* load __sk_buff->data */        r3 = *(u32 *)(r1 + 80) /* load __sk_buff->data_end */        r0 = r2        r0 += 8        if r3 > r0 goto +1        ...Note that __sk_buff->data load has 32-bit sign extension.After verification and convert_ctx_accesses(), the final asm code looks like:        r2 = *(u64 *)(r1 +208)        r2 = (s32)r2        r3 = *(u64 *)(r1 +80)        r0 = r2        r0 += 8        if r3 > r0 goto pc+1        ...Note that  r2 = (s32)r2  may make the kernel __sk_buff->data address invalidwhich may cause runtime failure.Currently, in C code, typically we have        void *data = (void *)(long)skb->data;        void *data_end = (void *)(long)skb->data_end;        ...and it will generate        r2 = *(u64 *)(r1 +208)        r3 = *(u64 *)(r1 +80)        r0 = r2        r0 += 8        if r3 > r0 goto pc+1If we allow sign-extension,        void *data = (void *)(long)(int)skb->data;        void *data_end = (void *)(long)skb->data_end;        ...the generated code looks like        r2 = *(u64 *)(r1 +208)        r2 <<= 32        r2 s>>= 32        r3 = *(u64 *)(r1 +80)        r0 = r2        r0 += 8        if r3 > r0 goto pc+1and this will cause verification failure since  r2 <<= 32  is not allowedas  r2  is a packet pointer.To fix this issue for case  r2 = *(s32 *)(r1 + 76) /* load __sk_buff->data */this patch added additional checking in is_valid_access() callbackfunction for packet data/data_end/data_meta access. If those accessesare with sign-extenstion, the verification will fail.  [1] https://lore.kernel.org/bpf/000000000000c90eee061d236d37@google.com/
 漏洞公开时间：2024-10-21 20:15:06
 漏洞创建时间：2024-10-21 20:42:30
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2024-47702
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/92de36080c93296ef9005690705cba260b9bd68a |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/f09757fe97a225ae505886eac572e4cbfba96537 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/f1620c93a1ec950d87ef327a565d3907736d3340 |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-47702 | https://bugzilla.suse.com/show_bug.cgi?id=1231924 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2024-47702 | https://bugzilla.suse.com/show_bug.cgi?id=1231924 |
| suse_bugzilla | https://git.kernel.org/stable/c/92de36080c93296ef9005690705cba260b9bd68a | https://bugzilla.suse.com/show_bug.cgi?id=1231924 |
| suse_bugzilla | https://git.kernel.org/stable/c/f09757fe97a225ae505886eac572e4cbfba96537 | https://bugzilla.suse.com/show_bug.cgi?id=1231924 |
| suse_bugzilla | https://git.kernel.org/stable/c/f1620c93a1ec950d87ef327a565d3907736d3340 | https://bugzilla.suse.com/show_bug.cgi?id=1231924 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2024/CVE-2024-47702.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1231924 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2320179 | https://bugzilla.suse.com/show_bug.cgi?id=1231924 |
| redhat_bugzilla | https://lore.kernel.org/bpf/000000000000c90eee061d236d37@google.com/ | https://bugzilla.redhat.com/show_bug.cgi?id=2320179 |
| redhat_bugzilla | https://lore.kernel.org/linux-cve-announce/2024102115-CVE-2024-47702-c5c4@gregkh/T | https://bugzilla.redhat.com/show_bug.cgi?id=2320179 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2024-47702 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://git.kernel.org/stable/c/92de36080c93296ef9005690705cba260b9bd68a |  | nvd |
|  |  | https://git.kernel.org/stable/c/f09757fe97a225ae505886eac572e4cbfba96537 |  | nvd |
|  |  | https://git.kernel.org/stable/c/f1620c93a1ec950d87ef327a565d3907736d3340 |  | nvd |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:bpf: Fail verification for sign-extension of packet data/data_end/data_metasyzbot reported a kernel crash due to  commit 1f1e864b6555 (&#34;bpf: Handle sign-extenstin ctx member accesses&#34;).The reason is due to sign-extension of 32-bit load forpacket data/data_end/data_meta uapi field.The original code looks like:        r2 = *(s32 *)(r1 + 76) /* load __sk_buff-&gt;data */        r3 = *(u32 *)(r1 + 80) /* load __sk_buff-&gt;data_end */        r0 = r2        r0 += 8        if r3 &gt; r0 goto +1        ...Note that __sk_buff-&gt;data load has 32-bit sign extension.After verification and convert_ctx_accesses(), the final asm code looks like:        r2 = *(u64 *)(r1 +208)        r2 = (s32)r2        r3 = *(u64 *)(r1 +80)        r0 = r2        r0 += 8        if r3 &gt; r0 goto pc+1        ...Note that &#39;r2 = (s32)r2&#39; may make the kernel __sk_buff-&gt;data address invalidwhich may cause runtime failure.Currently, in C code, typically we have        void *data = (void *)(long)skb-&gt;data;        void *data_end = (void *)(long)skb-&gt;data_end;        ...and it will generate        r2 = *(u64 *)(r1 +208)        r3 = *(u64 *)(r1 +80)        r0 = r2        r0 += 8        if r3 &gt; r0 goto pc+1If we allow sign-extension,        void *data = (void *)(long)(int)skb-&gt;data;        void *data_end = (void *)(long)skb-&gt;data_end;        ...the generated code looks like        r2 = *(u64 *)(r1 +208)        r2 &lt;&lt;= 32        r2 s&gt;&gt;= 32        r3 = *(u64 *)(r1 +80)        r0 = r2        r0 += 8        if r3 &gt; r0 goto pc+1and this will cause verification failure since &#34;r2 &lt;&lt;= 32&#34; is not allowedas &#34;r2&#34; is a packet pointer.To fix this issue for case  r2 = *(s32 *)(r1 + 76) /* load __sk_buff-&gt;data */this patch added additional checking in is_valid_access() callbackfunction for packet data/data_end/data_meta access. If those accessesare with sign-extenstion, the verification will fail.  [1] <ahref= https://lore.kernel.org/bpf/000000000000c90eee061d236d37@google.com/ >https://lore.kernel.org/bpf/000000000000c90eee061d236d37@google.com/</a>The Linux kernel CVE team has assigned CVE-2024-47702 to this issue.
 openEuler评分：
  5.5
 Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-24.03-LTS(6.6.0):受影响
2.openEuler-20.03-LTS-SP4(4.19.90):不受影响
3.openEuler-22.03-LTS-SP1(5.10.0):不受影响
4.openEuler-22.03-LTS-SP3(5.10.0):不受影响
5.openEuler-22.03-LTS-SP4(5.10.0):不受影响
6.master(6.6.0):不受影响
7.openEuler-24.03-LTS-Next(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP4(4.19.90):否
2.openEuler-22.03-LTS-SP1(5.10.0):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.master(6.6.0):否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-22.03-LTS-SP4(5.10.0):否

原因说明：
  1.master(6.6.0):
2.openEuler-20.03-LTS-SP4(4.19.90):
3.openEuler-22.03-LTS-SP1(5.10.0):
4.openEuler-22.03-LTS-SP3(5.10.0):
5.openEuler-22.03-LTS-SP4(5.10.0):
6.openEuler-24.03-LTS(6.6.0):
7.openEuler-24.03-LTS-Next(6.6.0):
8.openEuler-24.03-LTS-SP1:

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2024-2423

src-openEuler/kernel
Closed

Content Risk Flag

Comments (5)

src-openEuler/kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2024-47702

Comments (5)

Search

src-openEuler/kernel
Closed