CVE-2024-49878

一、漏洞信息
 漏洞编号：[CVE-2024-49878](https://nvd.nist.gov/vuln/detail/CVE-2024-49878)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.0,6.1.14,6.1.19,6.1.5,6.1.6,6.1.8,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：5.5 Medium
  Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:resource: fix region_intersects() vs add_memory_driver_managed()On a system with CXL memory, the resource tree (/proc/iomem) related toCXL memory may look like something as follows.490000000-50fffffff : CXL Window 0  490000000-50fffffff : region0    490000000-50fffffff : dax0.0      490000000-50fffffff : System RAM (kmem)Because drivers/dax/kmem.c calls add_memory_driver_managed() duringonlining CXL memory, which makes  System RAM (kmem)  a descendant of  CXLWindow X .  This confuses region_intersects(), which expects all  SystemRAM  resources to be at the top level of iomem_resource.  This can lead tobugs.For example, when the following command line is executed to write somememory in CXL memory range via /dev/mem, $ dd if=data of=/dev/mem bs=$((1 << 10)) seek=$((0x490000000 >> 10)) count=1 dd: error writing  /dev/mem : Bad address 1+0 records in 0+0 records out 0 bytes copied, 0.0283507 s, 0.0 kB/sthe command fails as expected.  However, the error code is wrong.  Itshould be  Operation not permitted  instead of  Bad address .  Moreseriously, the /dev/mem permission checking in devmem_is_allowed() passesincorrectly.  Although the accessing is prevented later because ioremap()isn t allowed to map system RAM, it is a potential security issue.  Duringcommand executing, the following warning is reported in the kernel log forcalling ioremap() on system RAM. ioremap on RAM at 0x0000000490000000 - 0x0000000490000fff WARNING: CPU: 2 PID: 416 at arch/x86/mm/ioremap.c:216 __ioremap_caller.constprop.0+0x131/0x35d Call Trace:  memremap+0xcb/0x184  xlate_dev_mem_ptr+0x25/0x2f  write_mem+0x94/0xfb  vfs_write+0x128/0x26d  ksys_write+0xac/0xfe  do_syscall_64+0x9a/0xfd  entry_SYSCALL_64_after_hwframe+0x4b/0x53The details of command execution process are as follows.  In the aboveresource tree,  System RAM  is a descendant of  CXL Window 0  instead of atop level resource.  So, region_intersects() will report no System RAMresources in the CXL memory region incorrectly, because it only checks thetop level resources.  Consequently, devmem_is_allowed() will return 1(allow access via /dev/mem) for CXL memory region incorrectly. Fortunately, ioremap() doesn t allow to map System RAM and reject theaccess.So, region_intersects() needs to be fixed to work correctly with theresource tree with  System RAM  not at top level as above.  To fix it, ifwe found a unmatched resource in the top level, we will continue to searchmatched resources in its descendant resources.  So, we will not miss anymatched resources in resource tree anymore.In the new implementation, an example resource tree|-------------  CXL Window 0  ------------||--  System RAM  --|will behave similar as the following fake resource tree forregion_intersects(, IORESOURCE_SYSTEM_RAM, ),|--  System RAM  --||--  CXL Window 0a  --|Where  CXL Window 0a  is part of the original  CXL Window 0  thatisn t covered by  System RAM .
 漏洞公开时间：2024-10-22 02:15:09
 漏洞创建时间：2024-10-22 04:23:17
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2024-49878
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/06ff97a20b8c9e9d256b0d2c3e87f78f8ccea3de |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/1d5f85f1b7db79c75c9e07d6571ce2a7bdf725c4 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/333fbaf6864a4ca031367eb947961a1f3484d337 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/393331e16ce205e036e58b3d8ca4ee2e635f21d9 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/4b90d2eb451b357681063ba4552b10b39d7ad885 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/8a6fef7d22a1d952aed68584d3fcc0d018d2bdc3 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/927abc5b7d6d2c2e936bec5a2f71d9512c5e72f7 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/b4afe4183ec77f230851ea139d91e5cf2644c68b |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-49878 | https://bugzilla.suse.com/show_bug.cgi?id=1232340 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2024-49878 | https://bugzilla.suse.com/show_bug.cgi?id=1232340 |
| suse_bugzilla | https://git.kernel.org/stable/c/06ff97a20b8c9e9d256b0d2c3e87f78f8ccea3de | https://bugzilla.suse.com/show_bug.cgi?id=1232340 |
| suse_bugzilla | https://git.kernel.org/stable/c/1d5f85f1b7db79c75c9e07d6571ce2a7bdf725c4 | https://bugzilla.suse.com/show_bug.cgi?id=1232340 |
| suse_bugzilla | https://git.kernel.org/stable/c/393331e16ce205e036e58b3d8ca4ee2e635f21d9 | https://bugzilla.suse.com/show_bug.cgi?id=1232340 |
| suse_bugzilla | https://git.kernel.org/stable/c/4b90d2eb451b357681063ba4552b10b39d7ad885 | https://bugzilla.suse.com/show_bug.cgi?id=1232340 |
| suse_bugzilla | https://git.kernel.org/stable/c/8a6fef7d22a1d952aed68584d3fcc0d018d2bdc3 | https://bugzilla.suse.com/show_bug.cgi?id=1232340 |
| suse_bugzilla | https://git.kernel.org/stable/c/927abc5b7d6d2c2e936bec5a2f71d9512c5e72f7 | https://bugzilla.suse.com/show_bug.cgi?id=1232340 |
| suse_bugzilla | https://git.kernel.org/stable/c/b4afe4183ec77f230851ea139d91e5cf2644c68b | https://bugzilla.suse.com/show_bug.cgi?id=1232340 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2024/CVE-2024-49878.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1232340 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2320527 | https://bugzilla.suse.com/show_bug.cgi?id=1232340 |
| redhat_bugzilla | https://lore.kernel.org/linux-cve-announce/2024102115-CVE-2024-49878-8099@gregkh/T | https://bugzilla.redhat.com/show_bug.cgi?id=2320527 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2024-49878 |
| mageia |  | http://advisories.mageia.org/MGASA-2024-0345.html |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

无
</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:resource: fix region_intersects() vs add_memory_driver_managed()On a system with CXL memory, the resource tree (/proc/iomem) related toCXL memory may look like something as follows.490000000-50fffffff : CXL Window 0  490000000-50fffffff : region0    490000000-50fffffff : dax0.0      490000000-50fffffff : System RAM (kmem)Because drivers/dax/kmem.c calls add_memory_driver_managed() duringonlining CXL memory, which makes  System RAM (kmem)  a descendant of  CXLWindow X .  This confuses region_intersects(), which expects all  SystemRAM  resources to be at the top level of iomem_resource.  This can lead tobugs.For example, when the following command line is executed to write somememory in CXL memory range via /dev/mem, $ dd if=data of=/dev/mem bs=$((1 << 10)) seek=$((0x490000000 >> 10)) count=1 dd: error writing  /dev/mem : Bad address 1+0 records in 0+0 records out 0 bytes copied, 0.0283507 s, 0.0 kB/sthe command fails as expected.  However, the error code is wrong.  Itshould be  Operation not permitted  instead of  Bad address .  Moreseriously, the /dev/mem permission checking in devmem_is_allowed() passesincorrectly.  Although the accessing is prevented later because ioremap()isn t allowed to map system RAM, it is a potential security issue.  Duringcommand executing, the following warning is reported in the kernel log forcalling ioremap() on system RAM. ioremap on RAM at 0x0000000490000000 - 0x0000000490000fff WARNING: CPU: 2 PID: 416 at arch/x86/mm/ioremap.c:216 __ioremap_caller.constprop.0+0x131/0x35d Call Trace:  memremap+0xcb/0x184  xlate_dev_mem_ptr+0x25/0x2f  write_mem+0x94/0xfb  vfs_write+0x128/0x26d  ksys_write+0xac/0xfe  do_syscall_64+0x9a/0xfd  entry_SYSCALL_64_after_hwframe+0x4b/0x53The details of command execution process are as follows.  In the aboveresource tree,  System RAM  is a descendant of  CXL Window 0  instead of atop level resource.  So, region_intersects() will report no System RAMresources in the CXL memory region incorrectly, because it only checks thetop level resources.  Consequently, devmem_is_allowed() will return 1(allow access via /dev/mem) for CXL memory region incorrectly. Fortunately, ioremap() doesn t allow to map System RAM and reject theaccess.So, region_intersects() needs to be fixed to work correctly with theresource tree with  System RAM  not at top level as above.  To fix it, ifwe found a unmatched resource in the top level, we will continue to searchmatched resources in its descendant resources.  So, we will not miss anymatched resources in resource tree anymore.In the new implementation, an example resource tree|-------------  CXL Window 0  ------------||--  System RAM  --|will behave similar as the following fake resource tree forregion_intersects(, IORESOURCE_SYSTEM_RAM, ),|--  System RAM  --||--  CXL Window 0a  --|Where  CXL Window 0a  is part of the original  CXL Window 0  thatisn t covered by  System RAM .
 openEuler评分：
  3.9
 Vector：CVSS：3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP4(4.19.90):受影响
2.openEuler-22.03-LTS-SP1(5.10.0):受影响
3.openEuler-22.03-LTS-SP3(5.10.0):受影响
4.openEuler-22.03-LTS-SP4(5.10.0):受影响
5.openEuler-24.03-LTS(6.6.0):受影响
6.master(6.6.0):不受影响
7.openEuler-24.03-LTS-Next(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP4(4.19.90):否
2.openEuler-22.03-LTS-SP1(5.10.0):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.master(6.6.0):否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-22.03-LTS-SP4(5.10.0):否

原因说明：
  1.master(6.6.0):
2.openEuler-20.03-LTS-SP4(4.19.90):
3.openEuler-22.03-LTS-SP1(5.10.0):
4.openEuler-22.03-LTS-SP3(5.10.0):
5.openEuler-22.03-LTS-SP4(5.10.0):
6.openEuler-24.03-LTS(6.6.0):
7.openEuler-24.03-LTS-Next(6.6.0):
8.openEuler-24.03-LTS-SP1:

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2024-2426

src-openEuler/kernel

内容风险标识

评论 (7)

src-openEuler/kernel .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2024-49878

评论 (7)

搜索帮助

src-openEuler/kernel