CVE-2024-49942

一、漏洞信息
 漏洞编号：[CVE-2024-49942](https://nvd.nist.gov/vuln/detail/CVE-2024-49942)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.0,6.1.14,6.1.19,6.1.5,6.1.6,6.1.8,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：5.5 Medium
  Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:drm/xe: Prevent null pointer access in xe_migrate_copyxe_migrate_copy designed to copy content of TTM resources. When sourceresource is null, it will trigger a NULL pointer dereference inxe_migrate_copy. To avoid this situation, update lacks source flag totrue for this case, the flag will trigger xe_migrate_clear rather thanxe_migrate_copy.Issue trace:<7> [317.089847] xe 0000:00:02.0: [drm:xe_migrate_copy [xe]] Pass 14, sizes: 4194304 & 4194304<7> [317.089945] xe 0000:00:02.0: [drm:xe_migrate_copy [xe]] Pass 15, sizes: 4194304 & 4194304<1> [317.128055] BUG: kernel NULL pointer dereference, address: 0000000000000010<1> [317.128064] #PF: supervisor read access in kernel mode<1> [317.128066] #PF: error_code(0x0000) - not-present page<6> [317.128069] PGD 0 P4D 0<4> [317.128071] Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI<4> [317.128074] CPU: 1 UID: 0 PID: 1440 Comm: kunit_try_catch Tainted: G     U           N 6.11.0-rc7-xe #1<4> [317.128078] Tainted: [U]=USER, [N]=TEST<4> [317.128080] Hardware name: Intel Corporation Lunar Lake Client Platform/LNL-M LP5 RVP1, BIOS LNLMFWI1.R00.3221.D80.2407291239 07/29/2024<4> [317.128082] RIP: 0010:xe_migrate_copy+0x66/0x13e0 [xe]<4> [317.128158] Code: 00 00 48 89 8d e0 fe ff ff 48 8b 40 10 4c 89 85 c8 fe ff ff 44 88 8d bd fe ff ff 65 48 8b 3c 25 28 00 00 00 48 89 7d d0 31 ff <8b> 79 10 48 89 85 a0 fe ff ff 48 8b 00 48 89 b5 d8 fe ff ff 83 ff<4> [317.128162] RSP: 0018:ffffc9000167f9f0 EFLAGS: 00010246<4> [317.128164] RAX: ffff8881120d8028 RBX: ffff88814d070428 RCX: 0000000000000000<4> [317.128166] RDX: ffff88813cb99c00 RSI: 0000000004000000 RDI: 0000000000000000<4> [317.128168] RBP: ffffc9000167fbb8 R08: ffff88814e7b1f08 R09: 0000000000000001<4> [317.128170] R10: 0000000000000001 R11: 0000000000000001 R12: ffff88814e7b1f08<4> [317.128172] R13: ffff88814e7b1f08 R14: ffff88813cb99c00 R15: 0000000000000001<4> [317.128174] FS:  0000000000000000(0000) GS:ffff88846f280000(0000) knlGS:0000000000000000<4> [317.128176] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033<4> [317.128178] CR2: 0000000000000010 CR3: 000000011f676004 CR4: 0000000000770ef0<4> [317.128180] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000<4> [317.128182] DR3: 0000000000000000 DR6: 00000000ffff07f0 DR7: 0000000000000400<4> [317.128184] PKRU: 55555554<4> [317.128185] Call Trace:<4> [317.128187]  <TASK><4> [317.128189]  ? show_regs+0x67/0x70<4> [317.128194]  ? __die_body+0x20/0x70<4> [317.128196]  ? __die+0x2b/0x40<4> [317.128198]  ? page_fault_oops+0x15f/0x4e0<4> [317.128203]  ? do_user_addr_fault+0x3fb/0x970<4> [317.128205]  ? lock_acquire+0xc7/0x2e0<4> [317.128209]  ? exc_page_fault+0x87/0x2b0<4> [317.128212]  ? asm_exc_page_fault+0x27/0x30<4> [317.128216]  ? xe_migrate_copy+0x66/0x13e0 [xe]<4> [317.128263]  ? __lock_acquire+0xb9d/0x26f0<4> [317.128265]  ? __lock_acquire+0xb9d/0x26f0<4> [317.128267]  ? sg_free_append_table+0x20/0x80<4> [317.128271]  ? lock_acquire+0xc7/0x2e0<4> [317.128273]  ? mark_held_locks+0x4d/0x80<4> [317.128275]  ? trace_hardirqs_on+0x1e/0xd0<4> [317.128278]  ? _raw_spin_unlock_irqrestore+0x31/0x60<4> [317.128281]  ? __pm_runtime_resume+0x60/0xa0<4> [317.128284]  xe_bo_move+0x682/0xc50 [xe]<4> [317.128315]  ? lock_is_held_type+0xaa/0x120<4> [317.128318]  ttm_bo_handle_move_mem+0xe5/0x1a0 [ttm]<4> [317.128324]  ttm_bo_validate+0xd1/0x1a0 [ttm]<4> [317.128328]  shrink_test_run_device+0x721/0xc10 [xe]<4> [317.128360]  ? find_held_lock+0x31/0x90<4> [317.128363]  ? lock_release+0xd1/0x2a0<4> [317.128365]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [kunit]<4> [317.128370]  xe_bo_shrink_kunit+0x11/0x20 [xe]<4> [317.128397]  kunit_try_run_case+0x6e/0x150 [kunit]<4> [317.128400]  ? trace_hardirqs_on+0x1e/0xd0<4> [317.128402]  ? _raw_spin_unlock_irqrestore+0x31/0x60<4> [317.128404]  kunit_generic_run_threadfn_adapter+0x1e/0x40 [ku---truncated---
 漏洞公开时间：2024-10-22 02:15:15
 漏洞创建时间：2024-10-22 03:00:01
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2024-49942
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/16e0267db156f8a4ea16bfb3ac3f5743c9698df3 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/7257d9c9a3c6cfe26c428e9b7ae21d61f2f55a79 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/8f5199b6971f0717c2d31685953971fa2e1b9e1a |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-49942 | https://bugzilla.suse.com/show_bug.cgi?id=1232168 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2024-49942 | https://bugzilla.suse.com/show_bug.cgi?id=1232168 |
| suse_bugzilla | https://git.kernel.org/stable/c/16e0267db156f8a4ea16bfb3ac3f5743c9698df3 | https://bugzilla.suse.com/show_bug.cgi?id=1232168 |
| suse_bugzilla | https://git.kernel.org/stable/c/7257d9c9a3c6cfe26c428e9b7ae21d61f2f55a79 | https://bugzilla.suse.com/show_bug.cgi?id=1232168 |
| suse_bugzilla | https://git.kernel.org/stable/c/8f5199b6971f0717c2d31685953971fa2e1b9e1a | https://bugzilla.suse.com/show_bug.cgi?id=1232168 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2024/CVE-2024-49942.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1232168 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2320445 | https://bugzilla.suse.com/show_bug.cgi?id=1232168 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2024-49942 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://git.kernel.org/stable/c/16e0267db156f8a4ea16bfb3ac3f5743c9698df3 |  | nvd |
|  |  | https://git.kernel.org/stable/c/7257d9c9a3c6cfe26c428e9b7ae21d61f2f55a79 |  | nvd |
|  |  | https://git.kernel.org/stable/c/8f5199b6971f0717c2d31685953971fa2e1b9e1a |  | nvd |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:drm/xe: Prevent null pointer access in xe_migrate_copyxe_migrate_copy designed to copy content of TTM resources. When sourceresource is null, it will trigger a NULL pointer dereference inxe_migrate_copy. To avoid this situation, update lacks source flag totrue for this case, the flag will trigger xe_migrate_clear rather thanxe_migrate_copy.Issue trace:<7> [317.089847] xe 0000:00:02.0: [drm:xe_migrate_copy [xe]] Pass 14, sizes: 4194304 & 4194304<7> [317.089945] xe 0000:00:02.0: [drm:xe_migrate_copy [xe]] Pass 15, sizes: 4194304 & 4194304<1> [317.128055] BUG: kernel NULL pointer dereference, address: 0000000000000010<1> [317.128064] #PF: supervisor read access in kernel mode<1> [317.128066] #PF: error_code(0x0000) - not-present page<6> [317.128069] PGD 0 P4D 0<4> [317.128071] Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI<4> [317.128074] CPU: 1 UID: 0 PID: 1440 Comm: kunit_try_catch Tainted: G     U           N 6.11.0-rc7-xe #1<4> [317.128078] Tainted: [U]=USER, [N]=TEST<4> [317.128080] Hardware name: Intel Corporation Lunar Lake Client Platform/LNL-M LP5 RVP1, BIOS LNLMFWI1.R00.3221.D80.2407291239 07/29/2024<4> [317.128082] RIP: 0010:xe_migrate_copy+0x66/0x13e0 [xe]<4> [317.128158] Code: 00 00 48 89 8d e0 fe ff ff 48 8b 40 10 4c 89 85 c8 fe ff ff 44 88 8d bd fe ff ff 65 48 8b 3c 25 28 00 00 00 48 89 7d d0 31 ff <8b> 79 10 48 89 85 a0 fe ff ff 48 8b 00 48 89 b5 d8 fe ff ff 83 ff<4> [317.128162] RSP: 0018:ffffc9000167f9f0 EFLAGS: 00010246<4> [317.128164] RAX: ffff8881120d8028 RBX: ffff88814d070428 RCX: 0000000000000000<4> [317.128166] RDX: ffff88813cb99c00 RSI: 0000000004000000 RDI: 0000000000000000<4> [317.128168] RBP: ffffc9000167fbb8 R08: ffff88814e7b1f08 R09: 0000000000000001<4> [317.128170] R10: 0000000000000001 R11: 0000000000000001 R12: ffff88814e7b1f08<4> [317.128172] R13: ffff88814e7b1f08 R14: ffff88813cb99c00 R15: 0000000000000001<4> [317.128174] FS:  0000000000000000(0000) GS:ffff88846f280000(0000) knlGS:0000000000000000<4> [317.128176] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033<4> [317.128178] CR2: 0000000000000010 CR3: 000000011f676004 CR4: 0000000000770ef0<4> [317.128180] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000<4> [317.128182] DR3: 0000000000000000 DR6: 00000000ffff07f0 DR7: 0000000000000400<4> [317.128184] PKRU: 55555554<4> [317.128185] Call Trace:<4> [317.128187]  <TASK><4> [317.128189]  ? show_regs+0x67/0x70<4> [317.128194]  ? __die_body+0x20/0x70<4> [317.128196]  ? __die+0x2b/0x40<4> [317.128198]  ? page_fault_oops+0x15f/0x4e0<4> [317.128203]  ? do_user_addr_fault+0x3fb/0x970<4> [317.128205]  ? lock_acquire+0xc7/0x2e0<4> [317.128209]  ? exc_page_fault+0x87/0x2b0<4> [317.128212]  ? asm_exc_page_fault+0x27/0x30<4> [317.128216]  ? xe_migrate_copy+0x66/0x13e0 [xe]<4> [317.128263]  ? __lock_acquire+0xb9d/0x26f0<4> [317.128265]  ? __lock_acquire+0xb9d/0x26f0<4> [317.128267]  ? sg_free_append_table+0x20/0x80<4> [317.128271]  ? lock_acquire+0xc7/0x2e0<4> [317.128273]  ? mark_held_locks+0x4d/0x80<4> [317.128275]  ? trace_hardirqs_on+0x1e/0xd0<4> [317.128278]  ? _raw_spin_unlock_irqrestore+0x31/0x60<4> [317.128281]  ? __pm_runtime_resume+0x60/0xa0<4> [317.128284]  xe_bo_move+0x682/0xc50 [xe]<4> [317.128315]  ? lock_is_held_type+0xaa/0x120<4> [317.128318]  ttm_bo_handle_move_mem+0xe5/0x1a0 [ttm]<4> [317.128324]  ttm_bo_validate+0xd1/0x1a0 [ttm]<4> [317.128328]  shrink_test_run_device+0x721/0xc10 [xe]<4> [317.128360]  ? find_held_lock+0x31/0x90<4> [317.128363]  ? lock_release+0xd1/0x2a0<4> [317.128365]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [kunit]<4> [317.128370]  xe_bo_shrink_kunit+0x11/0x20 [xe]<4> [317.128397]  kunit_try_run_case+0x6e/0x150 [kunit]<4> [317.128400]  ? trace_hardirqs_on+0x1e/0xd0<4> [317.128402]  ? _raw_spin_unlock_irqrestore+0x31/0x60<4> [317.128404]  kunit_generic_run_threadfn_adapter+0x1e/0x40 [ku---truncated---
 openEuler评分：
  5.5
 Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP4(4.19.90):不受影响
2.openEuler-22.03-LTS-SP1(5.10.0):不受影响
3.openEuler-22.03-LTS-SP3(5.10.0):不受影响
4.openEuler-22.03-LTS-SP4(5.10.0):不受影响
5.master(6.6.0):不受影响
6.openEuler-24.03-LTS(6.6.0):不受影响
7.openEuler-24.03-LTS-Next(6.6.0):不受影响
8.openEuler-24.03-LTS-SP1(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP4(4.19.90):否
2.openEuler-22.03-LTS-SP1(5.10.0):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.master(6.6.0):否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-22.03-LTS-SP4(5.10.0):否
8.openEuler-24.03-LTS-SP1(6.6.0):否

原因说明：
  1.openEuler-20.03-LTS-SP4(4.19.90):不受影响-漏洞代码不存在
2.openEuler-22.03-LTS-SP1(5.10.0):不受影响-漏洞代码不存在
3.openEuler-22.03-LTS-SP3(5.10.0):不受影响-漏洞代码不存在
4.openEuler-22.03-LTS-SP4(5.10.0):不受影响-漏洞代码不存在
5.master(6.6.0):不受影响-漏洞代码不存在
6.openEuler-24.03-LTS(6.6.0):不受影响-漏洞代码不存在
7.openEuler-24.03-LTS-Next(6.6.0):不受影响-漏洞代码不存在
8.openEuler-24.03-LTS-SP1(6.6.0):不受影响-漏洞代码不存在

src-openEuler / kernel
Closed

Content Risk Flag

Comments (9)

src-openEuler / kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2024-49942

Comments (9)

Search

src-openEuler / kernel
Closed