CVE-2024-49886

一、漏洞信息
 漏洞编号：[CVE-2024-49886](https://nvd.nist.gov/vuln/detail/CVE-2024-49886)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.19,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：5.5 Medium
  Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:platform/x86: ISST: Fix the KASAN report slab-out-of-bounds bugAttaching SST PCI device to VM causes  BUG: KASAN: slab-out-of-bounds .kasan report:[   19.411889] ==================================================================[   19.413702] BUG: KASAN: slab-out-of-bounds in _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common][   19.415634] Read of size 8 at addr ffff888829e65200 by task cpuhp/16/113[   19.417368][   19.418627] CPU: 16 PID: 113 Comm: cpuhp/16 Tainted: G            E      6.9.0 #10[   19.420435] Hardware name: VMware, Inc. VMware20,1/440BX Desktop Reference Platform, BIOS VMW201.00V.20192059.B64.2207280713 07/28/2022[   19.422687] Call Trace:[   19.424091]  <TASK>[   19.425448]  dump_stack_lvl+0x5d/0x80[   19.426963]  ? _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common][   19.428694]  print_report+0x19d/0x52e[   19.430206]  ? __pfx__raw_spin_lock_irqsave+0x10/0x10[   19.431837]  ? _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common][   19.433539]  kasan_report+0xf0/0x170[   19.435019]  ? _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common][   19.436709]  _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common][   19.438379]  ? __pfx_sched_clock_cpu+0x10/0x10[   19.439910]  isst_if_cpu_online+0x406/0x58f [isst_if_common][   19.441573]  ? __pfx_isst_if_cpu_online+0x10/0x10 [isst_if_common][   19.443263]  ? ttwu_queue_wakelist+0x2c1/0x360[   19.444797]  cpuhp_invoke_callback+0x221/0xec0[   19.446337]  cpuhp_thread_fun+0x21b/0x610[   19.447814]  ? __pfx_cpuhp_thread_fun+0x10/0x10[   19.449354]  smpboot_thread_fn+0x2e7/0x6e0[   19.450859]  ? __pfx_smpboot_thread_fn+0x10/0x10[   19.452405]  kthread+0x29c/0x350[   19.453817]  ? __pfx_kthread+0x10/0x10[   19.455253]  ret_from_fork+0x31/0x70[   19.456685]  ? __pfx_kthread+0x10/0x10[   19.458114]  ret_from_fork_asm+0x1a/0x30[   19.459573]  </TASK>[   19.460853][   19.462055] Allocated by task 1198:[   19.463410]  kasan_save_stack+0x30/0x50[   19.464788]  kasan_save_track+0x14/0x30[   19.466139]  __kasan_kmalloc+0xaa/0xb0[   19.467465]  __kmalloc+0x1cd/0x470[   19.468748]  isst_if_cdev_register+0x1da/0x350 [isst_if_common][   19.470233]  isst_if_mbox_init+0x108/0xff0 [isst_if_mbox_msr][   19.471670]  do_one_initcall+0xa4/0x380[   19.472903]  do_init_module+0x238/0x760[   19.474105]  load_module+0x5239/0x6f00[   19.475285]  init_module_from_file+0xd1/0x130[   19.476506]  idempotent_init_module+0x23b/0x650[   19.477725]  __x64_sys_finit_module+0xbe/0x130[   19.476506]  idempotent_init_module+0x23b/0x650[   19.477725]  __x64_sys_finit_module+0xbe/0x130[   19.478920]  do_syscall_64+0x82/0x160[   19.480036]  entry_SYSCALL_64_after_hwframe+0x76/0x7e[   19.481292][   19.482205] The buggy address belongs to the object at ffff888829e65000 which belongs to the cache kmalloc-512 of size 512[   19.484818] The buggy address is located 0 bytes to the right of allocated 512-byte region [ffff888829e65000, ffff888829e65200)[   19.487447][   19.488328] The buggy address belongs to the physical page:[   19.489569] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888829e60c00 pfn:0x829e60[   19.491140] head: order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0[   19.492466] anon flags: 0x57ffffc0000840(slab|head|node=1|zone=2|lastcpupid=0x1fffff)[   19.493914] page_type: 0xffffffff()[   19.494988] raw: 0057ffffc0000840 ffff88810004cc80 0000000000000000 0000000000000001[   19.496451] raw: ffff888829e60c00 0000000080200018 00000001ffffffff 0000000000000000[   19.497906] head: 0057ffffc0000840 ffff88810004cc80 0000000000000000 0000000000000001[   19.499379] head: ffff888829e60c00 0000000080200018 00000001ffffffff 0000000000000000[   19.500844] head: 0057ffffc0000003 ffffea0020a79801 ffffea0020a79848 00000000ffffffff[   19.502316] head: 0000000800000000 0000000000000000 00000000ffffffff 0000000000000000[   19.503784] page dumped because: k---truncated---
 漏洞公开时间：2024-10-22 02:15:11
 漏洞创建时间：2024-10-22 02:59:53
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2024-49886
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/1973c4d8ee0782a808303d75e3be9c12baaacd97 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/7d59ac07ccb58f8f604f8057db63b8efcebeb3de |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/8176d4878ed2af5d93ddd0e971e24c412124d38b |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/afa7f78d9a907cfded6c98c91aae2bf7b3b56e51 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/cdd03afcb6eda3103da5a0948d3db12372f62910 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/cebc705b097d5c16469b141a25e840161d1c517a |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-49886 | https://bugzilla.suse.com/show_bug.cgi?id=1232196 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2024-49886 | https://bugzilla.suse.com/show_bug.cgi?id=1232196 |
| suse_bugzilla | https://git.kernel.org/stable/c/1973c4d8ee0782a808303d75e3be9c12baaacd97 | https://bugzilla.suse.com/show_bug.cgi?id=1232196 |
| suse_bugzilla | https://git.kernel.org/stable/c/7d59ac07ccb58f8f604f8057db63b8efcebeb3de | https://bugzilla.suse.com/show_bug.cgi?id=1232196 |
| suse_bugzilla | https://git.kernel.org/stable/c/8176d4878ed2af5d93ddd0e971e24c412124d38b | https://bugzilla.suse.com/show_bug.cgi?id=1232196 |
| suse_bugzilla | https://git.kernel.org/stable/c/afa7f78d9a907cfded6c98c91aae2bf7b3b56e51 | https://bugzilla.suse.com/show_bug.cgi?id=1232196 |
| suse_bugzilla | https://git.kernel.org/stable/c/cdd03afcb6eda3103da5a0948d3db12372f62910 | https://bugzilla.suse.com/show_bug.cgi?id=1232196 |
| suse_bugzilla | https://git.kernel.org/stable/c/cebc705b097d5c16469b141a25e840161d1c517a | https://bugzilla.suse.com/show_bug.cgi?id=1232196 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2024/CVE-2024-49886.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1232196 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2320488 | https://bugzilla.suse.com/show_bug.cgi?id=1232196 |
| redhat_bugzilla | https://lore.kernel.org/linux-cve-announce/2024102117-CVE-2024-49886-3477@gregkh/T | https://bugzilla.redhat.com/show_bug.cgi?id=2320488 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2024-49886 |
| anolis |  | https://anas.openanolis.cn/cves/detail/CVE-2024-49886 |
| mageia |  | http://advisories.mageia.org/MGASA-2024-0345.html |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://git.kernel.org/stable/c/1973c4d8ee0782a808303d75e3be9c12baaacd97 |  | nvd |
|  |  | https://git.kernel.org/stable/c/7d59ac07ccb58f8f604f8057db63b8efcebeb3de |  | nvd |
|  |  | https://git.kernel.org/stable/c/8176d4878ed2af5d93ddd0e971e24c412124d38b |  | nvd |
|  |  | https://git.kernel.org/stable/c/afa7f78d9a907cfded6c98c91aae2bf7b3b56e51 |  | nvd |
|  |  | https://git.kernel.org/stable/c/cdd03afcb6eda3103da5a0948d3db12372f62910 |  | nvd |
|  |  | https://git.kernel.org/stable/c/cebc705b097d5c16469b141a25e840161d1c517a |  | nvd |
| linux_kernel | 5.15.168 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1973c4d8ee07Issue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=017a634f9f38 | linuxkernelcves |
| linux_kernel | 6.1.113 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=cdd03afcb6edIssue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=017a634f9f38 | linuxkernelcves |
| linux_kernel | 6.6.55 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=8176d4878ed2Issue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=017a634f9f38 | linuxkernelcves |
| linux_kernel | 6.10.14 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=cebc705b097dIssue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=017a634f9f38 | linuxkernelcves |
| linux_kernel | 6.11.3 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=afa7f78d9a90Issue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=017a634f9f38 | linuxkernelcves |
| linux_kernel | 6.12-rc2 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=7d59ac07ccb5Please | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=017a634f9f38 | linuxkernelcves |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:platform/x86: ISST: Fix the KASAN report slab-out-of-bounds bugAttaching SST PCI device to VM causes  BUG: KASAN: slab-out-of-bounds .kasan report:[   19.411889] ==================================================================[   19.413702] BUG: KASAN: slab-out-of-bounds in _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common][   19.415634] Read of size 8 at addr ffff888829e65200 by task cpuhp/16/113[   19.417368][   19.418627] CPU: 16 PID: 113 Comm: cpuhp/16 Tainted: G            E      6.9.0 #10[   19.420435] Hardware name: VMware, Inc. VMware20,1/440BX Desktop Reference Platform, BIOS VMW201.00V.20192059.B64.2207280713 07/28/2022[   19.422687] Call Trace:[   19.424091]  <TASK>[   19.425448]  dump_stack_lvl+0x5d/0x80[   19.426963]  ? _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common][   19.428694]  print_report+0x19d/0x52e[   19.430206]  ? __pfx__raw_spin_lock_irqsave+0x10/0x10[   19.431837]  ? _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common][   19.433539]  kasan_report+0xf0/0x170[   19.435019]  ? _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common][   19.436709]  _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common][   19.438379]  ? __pfx_sched_clock_cpu+0x10/0x10[   19.439910]  isst_if_cpu_online+0x406/0x58f [isst_if_common][   19.441573]  ? __pfx_isst_if_cpu_online+0x10/0x10 [isst_if_common][   19.443263]  ? ttwu_queue_wakelist+0x2c1/0x360[   19.444797]  cpuhp_invoke_callback+0x221/0xec0[   19.446337]  cpuhp_thread_fun+0x21b/0x610[   19.447814]  ? __pfx_cpuhp_thread_fun+0x10/0x10[   19.449354]  smpboot_thread_fn+0x2e7/0x6e0[   19.450859]  ? __pfx_smpboot_thread_fn+0x10/0x10[   19.452405]  kthread+0x29c/0x350[   19.453817]  ? __pfx_kthread+0x10/0x10[   19.455253]  ret_from_fork+0x31/0x70[   19.456685]  ? __pfx_kthread+0x10/0x10[   19.458114]  ret_from_fork_asm+0x1a/0x30[   19.459573]  </TASK>[   19.460853][   19.462055] Allocated by task 1198:[   19.463410]  kasan_save_stack+0x30/0x50[   19.464788]  kasan_save_track+0x14/0x30[   19.466139]  __kasan_kmalloc+0xaa/0xb0[   19.467465]  __kmalloc+0x1cd/0x470[   19.468748]  isst_if_cdev_register+0x1da/0x350 [isst_if_common][   19.470233]  isst_if_mbox_init+0x108/0xff0 [isst_if_mbox_msr][   19.471670]  do_one_initcall+0xa4/0x380[   19.472903]  do_init_module+0x238/0x760[   19.474105]  load_module+0x5239/0x6f00[   19.475285]  init_module_from_file+0xd1/0x130[   19.476506]  idempotent_init_module+0x23b/0x650[   19.477725]  __x64_sys_finit_module+0xbe/0x130[   19.476506]  idempotent_init_module+0x23b/0x650[   19.477725]  __x64_sys_finit_module+0xbe/0x130[   19.478920]  do_syscall_64+0x82/0x160[   19.480036]  entry_SYSCALL_64_after_hwframe+0x76/0x7e[   19.481292][   19.482205] The buggy address belongs to the object at ffff888829e65000 which belongs to the cache kmalloc-512 of size 512[   19.484818] The buggy address is located 0 bytes to the right of allocated 512-byte region [ffff888829e65000, ffff888829e65200)[   19.487447][   19.488328] The buggy address belongs to the physical page:[   19.489569] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888829e60c00 pfn:0x829e60[   19.491140] head: order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0[   19.492466] anon flags: 0x57ffffc0000840(slab|head|node=1|zone=2|lastcpupid=0x1fffff)[   19.493914] page_type: 0xffffffff()[   19.494988] raw: 0057ffffc0000840 ffff88810004cc80 0000000000000000 0000000000000001[   19.496451] raw: ffff888829e60c00 0000000080200018 00000001ffffffff 0000000000000000[   19.497906] head: 0057ffffc0000840 ffff88810004cc80 0000000000000000 0000000000000001[   19.499379] head: ffff888829e60c00 0000000080200018 00000001ffffffff 0000000000000000[   19.500844] head: 0057ffffc0000003 ffffea0020a79801 ffffea0020a79848 00000000ffffffff[   19.502316] head: 0000000800000000 0000000000000000 00000000ffffffff 0000000000000000[   19.503784] page dumped because: k---truncated---
 openEuler评分：
  5.5
 Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-22.03-LTS-SP1:受影响
2.openEuler-22.03-LTS-SP3:受影响
3.openEuler-22.03-LTS-SP4:受影响
4.openEuler-24.03-LTS:受影响
5.openEuler-20.03-LTS-SP4:不受影响
6.master:不受影响
7.openEuler-24.03-LTS-Next:不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP4:否
2.openEuler-22.03-LTS-SP1:否
3.openEuler-22.03-LTS-SP3:否
4.master:否
5.openEuler-24.03-LTS:否
6.openEuler-24.03-LTS-Next:否
7.openEuler-22.03-LTS-SP4:否

原因说明：
  1.master:
2.openEuler-20.03-LTS-SP4:
3.openEuler-22.03-LTS-SP3:
4.openEuler-22.03-LTS-SP4:
5.openEuler-24.03-LTS:
6.openEuler-24.03-LTS-Next:
7.openEuler-24.03-LTS-SP1:
8.openEuler-24.03-LTS-SP2:

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2024-2367

src-openEuler / kernel
Closed

Content Risk Flag

Comments (6)

src-openEuler / kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2024-49886

Comments (6)

Search

src-openEuler / kernel
Closed