CVE-2024-47685

一、漏洞信息
 漏洞编号：[CVE-2024-47685](https://nvd.nist.gov/vuln/detail/CVE-2024-47685)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.0,6.1.14,6.1.19,6.1.5,6.1.6,6.1.8,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：9.1 Critical
  Vector：CVSS：3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put()syzbot reported that nf_reject_ip6_tcphdr_put() was possibly sendinggarbage on the four reserved tcp bits (th->res1)Use skb_put_zero() to clear the whole TCP header,as done in nf_reject_ip_tcphdr_put()BUG: KMSAN: uninit-value in nf_reject_ip6_tcphdr_put+0x688/0x6c0 net/ipv6/netfilter/nf_reject_ipv6.c:255  nf_reject_ip6_tcphdr_put+0x688/0x6c0 net/ipv6/netfilter/nf_reject_ipv6.c:255  nf_send_reset6+0xd84/0x15b0 net/ipv6/netfilter/nf_reject_ipv6.c:344  nft_reject_inet_eval+0x3c1/0x880 net/netfilter/nft_reject_inet.c:48  expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline]  nft_do_chain+0x438/0x22a0 net/netfilter/nf_tables_core.c:288  nft_do_chain_inet+0x41a/0x4f0 net/netfilter/nft_chain_filter.c:161  nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline]  nf_hook_slow+0xf4/0x400 net/netfilter/core.c:626  nf_hook include/linux/netfilter.h:269 [inline]  NF_HOOK include/linux/netfilter.h:312 [inline]  ipv6_rcv+0x29b/0x390 net/ipv6/ip6_input.c:310  __netif_receive_skb_one_core net/core/dev.c:5661 [inline]  __netif_receive_skb+0x1da/0xa00 net/core/dev.c:5775  process_backlog+0x4ad/0xa50 net/core/dev.c:6108  __napi_poll+0xe7/0x980 net/core/dev.c:6772  napi_poll net/core/dev.c:6841 [inline]  net_rx_action+0xa5a/0x19b0 net/core/dev.c:6963  handle_softirqs+0x1ce/0x800 kernel/softirq.c:554  __do_softirq+0x14/0x1a kernel/softirq.c:588  do_softirq+0x9a/0x100 kernel/softirq.c:455  __local_bh_enable_ip+0x9f/0xb0 kernel/softirq.c:382  local_bh_enable include/linux/bottom_half.h:33 [inline]  rcu_read_unlock_bh include/linux/rcupdate.h:908 [inline]  __dev_queue_xmit+0x2692/0x5610 net/core/dev.c:4450  dev_queue_xmit include/linux/netdevice.h:3105 [inline]  neigh_resolve_output+0x9ca/0xae0 net/core/neighbour.c:1565  neigh_output include/net/neighbour.h:542 [inline]  ip6_finish_output2+0x2347/0x2ba0 net/ipv6/ip6_output.c:141  __ip6_finish_output net/ipv6/ip6_output.c:215 [inline]  ip6_finish_output+0xbb8/0x14b0 net/ipv6/ip6_output.c:226  NF_HOOK_COND include/linux/netfilter.h:303 [inline]  ip6_output+0x356/0x620 net/ipv6/ip6_output.c:247  dst_output include/net/dst.h:450 [inline]  NF_HOOK include/linux/netfilter.h:314 [inline]  ip6_xmit+0x1ba6/0x25d0 net/ipv6/ip6_output.c:366  inet6_csk_xmit+0x442/0x530 net/ipv6/inet6_connection_sock.c:135  __tcp_transmit_skb+0x3b07/0x4880 net/ipv4/tcp_output.c:1466  tcp_transmit_skb net/ipv4/tcp_output.c:1484 [inline]  tcp_connect+0x35b6/0x7130 net/ipv4/tcp_output.c:4143  tcp_v6_connect+0x1bcc/0x1e40 net/ipv6/tcp_ipv6.c:333  __inet_stream_connect+0x2ef/0x1730 net/ipv4/af_inet.c:679  inet_stream_connect+0x6a/0xd0 net/ipv4/af_inet.c:750  __sys_connect_file net/socket.c:2061 [inline]  __sys_connect+0x606/0x690 net/socket.c:2078  __do_sys_connect net/socket.c:2088 [inline]  __se_sys_connect net/socket.c:2085 [inline]  __x64_sys_connect+0x91/0xe0 net/socket.c:2085  x64_sys_call+0x27a5/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:43  do_syscall_x64 arch/x86/entry/common.c:52 [inline]  do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7fUninit was stored to memory at:  nf_reject_ip6_tcphdr_put+0x60c/0x6c0 net/ipv6/netfilter/nf_reject_ipv6.c:249  nf_send_reset6+0xd84/0x15b0 net/ipv6/netfilter/nf_reject_ipv6.c:344  nft_reject_inet_eval+0x3c1/0x880 net/netfilter/nft_reject_inet.c:48  expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline]  nft_do_chain+0x438/0x22a0 net/netfilter/nf_tables_core.c:288  nft_do_chain_inet+0x41a/0x4f0 net/netfilter/nft_chain_filter.c:161  nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline]  nf_hook_slow+0xf4/0x400 net/netfilter/core.c:626  nf_hook include/linux/netfilter.h:269 [inline]  NF_HOOK include/linux/netfilter.h:312 [inline]  ipv6_rcv+0x29b/0x390 net/ipv6/ip6_input.c:310  __netif_receive_skb_one_core---truncated---
 漏洞公开时间：2024-10-21 20:15:05
 漏洞创建时间：2024-10-21 20:43:28
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2024-47685
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/10210658f827ad45061581cbfc05924b723e8922 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/7a7b5a27c53b55e91eecf646d1b204e73fa4af93 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/7ea2bcfd9bf4c3dbbf22546162226fd1c14d8ad2 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/9c778fe48d20ef362047e3376dee56d77f8500d4 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/af4b8a704f26f38310655bad67fd8096293275a2 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/dcf48ab3ca2c55b09c8f9c8de0df01c1943bc4e5 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/fbff87d682e57ddbbe82abf6d0a1a4a36a98afcd |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-47685 | https://bugzilla.suse.com/show_bug.cgi?id=1231998 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2024/CVE-2024-47685.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1231998 |
| suse_bugzilla | https://git.kernel.org/stable/c/dcf48ab3ca2c55b09c8f9c8de0df01c1943bc4e5 | https://bugzilla.suse.com/show_bug.cgi?id=1231998 |
| suse_bugzilla | https://git.kernel.org/stable/c/fbff87d682e57ddbbe82abf6d0a1a4a36a98afcd | https://bugzilla.suse.com/show_bug.cgi?id=1231998 |
| suse_bugzilla | https://git.kernel.org/stable/c/7ea2bcfd9bf4c3dbbf22546162226fd1c14d8ad2 | https://bugzilla.suse.com/show_bug.cgi?id=1231998 |
| suse_bugzilla | https://git.kernel.org/stable/c/af4b8a704f26f38310655bad67fd8096293275a2 | https://bugzilla.suse.com/show_bug.cgi?id=1231998 |
| suse_bugzilla | https://git.kernel.org/stable/c/7a7b5a27c53b55e91eecf646d1b204e73fa4af93 | https://bugzilla.suse.com/show_bug.cgi?id=1231998 |
| suse_bugzilla | https://git.kernel.org/stable/c/10210658f827ad45061581cbfc05924b723e8922 | https://bugzilla.suse.com/show_bug.cgi?id=1231998 |
| suse_bugzilla | https://git.kernel.org/stable/c/9c778fe48d20ef362047e3376dee56d77f8500d4 | https://bugzilla.suse.com/show_bug.cgi?id=1231998 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2024-47685 | https://bugzilla.suse.com/show_bug.cgi?id=1231998 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2320268 | https://bugzilla.suse.com/show_bug.cgi?id=1231998 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2024-47685 |
| amazon_linux_explore | https://access.redhat.com/security/cve/CVE-2024-47685 | https://explore.alas.aws.amazon.com/CVE-2024-47685.html |
| amazon_linux_explore | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47685 | https://explore.alas.aws.amazon.com/CVE-2024-47685.html |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://git.kernel.org/stable/c/10210658f827ad45061581cbfc05924b723e8922 |  | nvd |
|  |  | https://git.kernel.org/stable/c/7a7b5a27c53b55e91eecf646d1b204e73fa4af93 |  | nvd |
|  |  | https://git.kernel.org/stable/c/7ea2bcfd9bf4c3dbbf22546162226fd1c14d8ad2 |  | nvd |
|  |  | https://git.kernel.org/stable/c/9c778fe48d20ef362047e3376dee56d77f8500d4 |  | nvd |
|  |  | https://git.kernel.org/stable/c/af4b8a704f26f38310655bad67fd8096293275a2 |  | nvd |
|  |  | https://git.kernel.org/stable/c/dcf48ab3ca2c55b09c8f9c8de0df01c1943bc4e5 |  | nvd |
|  |  | https://git.kernel.org/stable/c/fbff87d682e57ddbbe82abf6d0a1a4a36a98afcd |  | nvd |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put()syzbot reported that nf_reject_ip6_tcphdr_put() was possibly sendinggarbage on the four reserved tcp bits (th-&gt;res1)Use skb_put_zero() to clear the whole TCP header,as done in nf_reject_ip_tcphdr_put()BUG: KMSAN: uninit-value in nf_reject_ip6_tcphdr_put+0x688/0x6c0 net/ipv6/netfilter/nf_reject_ipv6.c:255  nf_reject_ip6_tcphdr_put+0x688/0x6c0 net/ipv6/netfilter/nf_reject_ipv6.c:255  nf_send_reset6+0xd84/0x15b0 net/ipv6/netfilter/nf_reject_ipv6.c:344  nft_reject_inet_eval+0x3c1/0x880 net/netfilter/nft_reject_inet.c:48  expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline]  nft_do_chain+0x438/0x22a0 net/netfilter/nf_tables_core.c:288  nft_do_chain_inet+0x41a/0x4f0 net/netfilter/nft_chain_filter.c:161  nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline]  nf_hook_slow+0xf4/0x400 net/netfilter/core.c:626  nf_hook include/linux/netfilter.h:269 [inline]  NF_HOOK include/linux/netfilter.h:312 [inline]  ipv6_rcv+0x29b/0x390 net/ipv6/ip6_input.c:310  __netif_receive_skb_one_core net/core/dev.c:5661 [inline]  __netif_receive_skb+0x1da/0xa00 net/core/dev.c:5775  process_backlog+0x4ad/0xa50 net/core/dev.c:6108  __napi_poll+0xe7/0x980 net/core/dev.c:6772  napi_poll net/core/dev.c:6841 [inline]  net_rx_action+0xa5a/0x19b0 net/core/dev.c:6963  handle_softirqs+0x1ce/0x800 kernel/softirq.c:554  __do_softirq+0x14/0x1a kernel/softirq.c:588  do_softirq+0x9a/0x100 kernel/softirq.c:455  __local_bh_enable_ip+0x9f/0xb0 kernel/softirq.c:382  local_bh_enable include/linux/bottom_half.h:33 [inline]  rcu_read_unlock_bh include/linux/rcupdate.h:908 [inline]  __dev_queue_xmit+0x2692/0x5610 net/core/dev.c:4450  dev_queue_xmit include/linux/netdevice.h:3105 [inline]  neigh_resolve_output+0x9ca/0xae0 net/core/neighbour.c:1565  neigh_output include/net/neighbour.h:542 [inline]  ip6_finish_output2+0x2347/0x2ba0 net/ipv6/ip6_output.c:141  __ip6_finish_output net/ipv6/ip6_output.c:215 [inline]  ip6_finish_output+0xbb8/0x14b0 net/ipv6/ip6_output.c:226  NF_HOOK_COND include/linux/netfilter.h:303 [inline]  ip6_output+0x356/0x620 net/ipv6/ip6_output.c:247  dst_output include/net/dst.h:450 [inline]  NF_HOOK include/linux/netfilter.h:314 [inline]  ip6_xmit+0x1ba6/0x25d0 net/ipv6/ip6_output.c:366  inet6_csk_xmit+0x442/0x530 net/ipv6/inet6_connection_sock.c:135  __tcp_transmit_skb+0x3b07/0x4880 net/ipv4/tcp_output.c:1466  tcp_transmit_skb net/ipv4/tcp_output.c:1484 [inline]  tcp_connect+0x35b6/0x7130 net/ipv4/tcp_output.c:4143  tcp_v6_connect+0x1bcc/0x1e40 net/ipv6/tcp_ipv6.c:333  __inet_stream_connect+0x2ef/0x1730 net/ipv4/af_inet.c:679  inet_stream_connect+0x6a/0xd0 net/ipv4/af_inet.c:750  __sys_connect_file net/socket.c:2061 [inline]  __sys_connect+0x606/0x690 net/socket.c:2078  __do_sys_connect net/socket.c:2088 [inline]  __se_sys_connect net/socket.c:2085 [inline]  __x64_sys_connect+0x91/0xe0 net/socket.c:2085  x64_sys_call+0x27a5/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:43  do_syscall_x64 arch/x86/entry/common.c:52 [inline]  do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7fUninit was stored to memory at:  nf_reject_ip6_tcphdr_put+0x60c/0x6c0 net/ipv6/netfilter/nf_reject_ipv6.c:249  nf_send_reset6+0xd84/0x15b0 net/ipv6/netfilter/nf_reject_ipv6.c:344  nft_reject_inet_eval+0x3c1/0x880 net/netfilter/nft_reject_inet.c:48  expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline]  nft_do_chain+0x438/0x22a0 net/netfilter/nf_tables_core.c:288  nft_do_chain_inet+0x41a/0x4f0 net/netfilter/nft_chain_filter.c:161  nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline]  nf_hook_slow+0xf4/0x400 net/netfilter/core.c:626  nf_hook include/linux/netfilter.h:269 [inline]  NF_HOOK include/linux/netfilter.h:312 [inline]  ipv6_rcv+0x29b/0x390 net/ipv6/ip6_input.c:310  __netif_receive_skb_one_core net/core/dev.c:5661 [inline]  __netif_receive_skb+0x1da/0xa00 net/core/dev.c:5775  process_backlog+0x4ad/0xa50 net/core/dev.c:6108  __napi_poll+0xe7/0x980 net/core/dev.c:6772  napi_poll
 openEuler评分：
  9.1
 Vector：CVSS：3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP4(4.19.90):受影响
2.openEuler-22.03-LTS-SP1(5.10.0):受影响
3.openEuler-22.03-LTS-SP3(5.10.0):受影响
4.openEuler-22.03-LTS-SP4(5.10.0):受影响
5.openEuler-24.03-LTS(6.6.0):受影响
6.master(6.6.0):不受影响
7.openEuler-24.03-LTS-Next(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP4(4.19.90):否
2.openEuler-22.03-LTS-SP1(5.10.0):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.master(6.6.0):否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-22.03-LTS-SP4(5.10.0):否

原因说明：
  1.master(6.6.0):
2.openEuler-20.03-LTS-SP4(4.19.90):
3.openEuler-22.03-LTS-SP1(5.10.0):
4.openEuler-22.03-LTS-SP3(5.10.0):
5.openEuler-22.03-LTS-SP4(5.10.0):
6.openEuler-24.03-LTS(6.6.0):
7.openEuler-24.03-LTS-Next(6.6.0):

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2024-2325

src-openEuler/kernel

内容风险标识

评论 (13)

src-openEuler/kernel .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2024-47685

评论 (13)

搜索帮助

src-openEuler/kernel