CVE-2024-50033

一、漏洞信息
 漏洞编号：[CVE-2024-50033](https://nvd.nist.gov/vuln/detail/CVE-2024-50033)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.19,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：7.1 High
  Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:slip: make slhc_remember() more robust against malicious packetssyzbot found that slhc_remember() was missing checks againstmalicious packets [1].slhc_remember() only checked the size of the packet was at least 20,which is not good enough.We need to make sure the packet includes the IPv4 and TCP headerthat are supposed to be carried.Add iph and th pointers to make the code more readable.[1]BUG: KMSAN: uninit-value in slhc_remember+0x2e8/0x7b0 drivers/net/slip/slhc.c:666  slhc_remember+0x2e8/0x7b0 drivers/net/slip/slhc.c:666  ppp_receive_nonmp_frame+0xe45/0x35e0 drivers/net/ppp/ppp_generic.c:2455  ppp_receive_frame drivers/net/ppp/ppp_generic.c:2372 [inline]  ppp_do_recv+0x65f/0x40d0 drivers/net/ppp/ppp_generic.c:2212  ppp_input+0x7dc/0xe60 drivers/net/ppp/ppp_generic.c:2327  pppoe_rcv_core+0x1d3/0x720 drivers/net/ppp/pppoe.c:379  sk_backlog_rcv+0x13b/0x420 include/net/sock.h:1113  __release_sock+0x1da/0x330 net/core/sock.c:3072  release_sock+0x6b/0x250 net/core/sock.c:3626  pppoe_sendmsg+0x2b8/0xb90 drivers/net/ppp/pppoe.c:903  sock_sendmsg_nosec net/socket.c:729 [inline]  __sock_sendmsg+0x30f/0x380 net/socket.c:744  ____sys_sendmsg+0x903/0xb60 net/socket.c:2602  ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2656  __sys_sendmmsg+0x3c1/0x960 net/socket.c:2742  __do_sys_sendmmsg net/socket.c:2771 [inline]  __se_sys_sendmmsg net/socket.c:2768 [inline]  __x64_sys_sendmmsg+0xbc/0x120 net/socket.c:2768  x64_sys_call+0xb6e/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:308  do_syscall_x64 arch/x86/entry/common.c:52 [inline]  do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7fUninit was created at:  slab_post_alloc_hook mm/slub.c:4091 [inline]  slab_alloc_node mm/slub.c:4134 [inline]  kmem_cache_alloc_node_noprof+0x6bf/0xb80 mm/slub.c:4186  kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:587  __alloc_skb+0x363/0x7b0 net/core/skbuff.c:678  alloc_skb include/linux/skbuff.h:1322 [inline]  sock_wmalloc+0xfe/0x1a0 net/core/sock.c:2732  pppoe_sendmsg+0x3a7/0xb90 drivers/net/ppp/pppoe.c:867  sock_sendmsg_nosec net/socket.c:729 [inline]  __sock_sendmsg+0x30f/0x380 net/socket.c:744  ____sys_sendmsg+0x903/0xb60 net/socket.c:2602  ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2656  __sys_sendmmsg+0x3c1/0x960 net/socket.c:2742  __do_sys_sendmmsg net/socket.c:2771 [inline]  __se_sys_sendmmsg net/socket.c:2768 [inline]  __x64_sys_sendmmsg+0xbc/0x120 net/socket.c:2768  x64_sys_call+0xb6e/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:308  do_syscall_x64 arch/x86/entry/common.c:52 [inline]  do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7fCPU: 0 UID: 0 PID: 5460 Comm: syz.2.33 Not tainted 6.12.0-rc2-syzkaller-00006-g87d6aab2389e #0Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
 漏洞公开时间：2024-10-22 04:15:16
 漏洞创建时间：2024-10-22 05:04:09
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2024-50033
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/29e8d96d44f51cf89a62dd042be35d052833b95c |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/36b054324d18e51cf466134e13b6fbe3c91f52af |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/5e336384cc9b608e0551f99c3d87316ca3b0e51a |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/7d3fce8cbe3a70a1c7c06c9b53696be5d5d8dd5c |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/8bb79eb1db85a10865f0d4dd15b013def3f2d246 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/ba6501ea06462d6404d57d5644cf2854db38e7d7 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/ff5e0f895315706e4ca5a19df15be6866cee4f5d |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-50033 | https://bugzilla.suse.com/show_bug.cgi?id=1231914 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2024-50033 | https://bugzilla.suse.com/show_bug.cgi?id=1231914 |
| suse_bugzilla | https://git.kernel.org/stable/c/29e8d96d44f51cf89a62dd042be35d052833b95c | https://bugzilla.suse.com/show_bug.cgi?id=1231914 |
| suse_bugzilla | https://git.kernel.org/stable/c/36b054324d18e51cf466134e13b6fbe3c91f52af | https://bugzilla.suse.com/show_bug.cgi?id=1231914 |
| suse_bugzilla | https://git.kernel.org/stable/c/5e336384cc9b608e0551f99c3d87316ca3b0e51a | https://bugzilla.suse.com/show_bug.cgi?id=1231914 |
| suse_bugzilla | https://git.kernel.org/stable/c/7d3fce8cbe3a70a1c7c06c9b53696be5d5d8dd5c | https://bugzilla.suse.com/show_bug.cgi?id=1231914 |
| suse_bugzilla | https://git.kernel.org/stable/c/8bb79eb1db85a10865f0d4dd15b013def3f2d246 | https://bugzilla.suse.com/show_bug.cgi?id=1231914 |
| suse_bugzilla | https://git.kernel.org/stable/c/ff5e0f895315706e4ca5a19df15be6866cee4f5d | https://bugzilla.suse.com/show_bug.cgi?id=1231914 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2024/CVE-2024-50033.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1231914 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2024-50033 |
| anolis |  | https://anas.openanolis.cn/cves/detail/CVE-2024-50033 |
| mageia |  | http://advisories.mageia.org/MGASA-2024-0345.html |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://git.kernel.org/stable/c/29e8d96d44f51cf89a62dd042be35d052833b95c |  | nvd |
|  |  | https://git.kernel.org/stable/c/36b054324d18e51cf466134e13b6fbe3c91f52af |  | nvd |
|  |  | https://git.kernel.org/stable/c/5e336384cc9b608e0551f99c3d87316ca3b0e51a |  | nvd |
|  |  | https://git.kernel.org/stable/c/7d3fce8cbe3a70a1c7c06c9b53696be5d5d8dd5c |  | nvd |
|  |  | https://git.kernel.org/stable/c/8bb79eb1db85a10865f0d4dd15b013def3f2d246 |  | nvd |
|  |  | https://git.kernel.org/stable/c/ff5e0f895315706e4ca5a19df15be6866cee4f5d |  | nvd |
| linux_kernel | 5.10.227 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=36b054324d18Issue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=b5451d783ade | linuxkernelcves |
| linux_kernel | 5.15.168 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=5e336384cc9bIssue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=b5451d783ade | linuxkernelcves |
| linux_kernel | 6.1.113 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=ff5e0f895315Issue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=b5451d783ade | linuxkernelcves |
| linux_kernel | 6.6.57 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=8bb79eb1db85Issue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=b5451d783ade | linuxkernelcves |
| linux_kernel | 6.11.4 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=29e8d96d44f5Issue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=b5451d783ade | linuxkernelcves |
| linux_kernel | 6.12-rc3 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=7d3fce8cbe3aPlease | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=b5451d783ade | linuxkernelcves |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:slip: make slhc_remember() more robust against malicious packetssyzbot found that slhc_remember() was missing checks againstmalicious packets [1].slhc_remember() only checked the size of the packet was at least 20,which is not good enough.We need to make sure the packet includes the IPv4 and TCP headerthat are supposed to be carried.Add iph and th pointers to make the code more readable.[1]BUG: KMSAN: uninit-value in slhc_remember+0x2e8/0x7b0 drivers/net/slip/slhc.c:666  slhc_remember+0x2e8/0x7b0 drivers/net/slip/slhc.c:666  ppp_receive_nonmp_frame+0xe45/0x35e0 drivers/net/ppp/ppp_generic.c:2455  ppp_receive_frame drivers/net/ppp/ppp_generic.c:2372 [inline]  ppp_do_recv+0x65f/0x40d0 drivers/net/ppp/ppp_generic.c:2212  ppp_input+0x7dc/0xe60 drivers/net/ppp/ppp_generic.c:2327  pppoe_rcv_core+0x1d3/0x720 drivers/net/ppp/pppoe.c:379  sk_backlog_rcv+0x13b/0x420 include/net/sock.h:1113  __release_sock+0x1da/0x330 net/core/sock.c:3072  release_sock+0x6b/0x250 net/core/sock.c:3626  pppoe_sendmsg+0x2b8/0xb90 drivers/net/ppp/pppoe.c:903  sock_sendmsg_nosec net/socket.c:729 [inline]  __sock_sendmsg+0x30f/0x380 net/socket.c:744  ____sys_sendmsg+0x903/0xb60 net/socket.c:2602  ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2656  __sys_sendmmsg+0x3c1/0x960 net/socket.c:2742  __do_sys_sendmmsg net/socket.c:2771 [inline]  __se_sys_sendmmsg net/socket.c:2768 [inline]  __x64_sys_sendmmsg+0xbc/0x120 net/socket.c:2768  x64_sys_call+0xb6e/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:308  do_syscall_x64 arch/x86/entry/common.c:52 [inline]  do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7fUninit was created at:  slab_post_alloc_hook mm/slub.c:4091 [inline]  slab_alloc_node mm/slub.c:4134 [inline]  kmem_cache_alloc_node_noprof+0x6bf/0xb80 mm/slub.c:4186  kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:587  __alloc_skb+0x363/0x7b0 net/core/skbuff.c:678  alloc_skb include/linux/skbuff.h:1322 [inline]  sock_wmalloc+0xfe/0x1a0 net/core/sock.c:2732  pppoe_sendmsg+0x3a7/0xb90 drivers/net/ppp/pppoe.c:867  sock_sendmsg_nosec net/socket.c:729 [inline]  __sock_sendmsg+0x30f/0x380 net/socket.c:744  ____sys_sendmsg+0x903/0xb60 net/socket.c:2602  ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2656  __sys_sendmmsg+0x3c1/0x960 net/socket.c:2742  __do_sys_sendmmsg net/socket.c:2771 [inline]  __se_sys_sendmmsg net/socket.c:2768 [inline]  __x64_sys_sendmmsg+0xbc/0x120 net/socket.c:2768  x64_sys_call+0xb6e/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:308  do_syscall_x64 arch/x86/entry/common.c:52 [inline]  do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7fCPU: 0 UID: 0 PID: 5460 Comm: syz.2.33 Not tainted 6.12.0-rc2-syzkaller-00006-g87d6aab2389e #0Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
 openEuler评分：
  7.1
 Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP4:受影响
2.openEuler-22.03-LTS-SP1:受影响
3.openEuler-22.03-LTS-SP3:受影响
4.openEuler-22.03-LTS-SP4:受影响
5.openEuler-24.03-LTS:受影响
6.master:不受影响
7.openEuler-24.03-LTS-Next:不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP4:否
2.openEuler-22.03-LTS-SP1:否
3.openEuler-22.03-LTS-SP3:否
4.master:否
5.openEuler-24.03-LTS:否
6.openEuler-24.03-LTS-Next:否
7.openEuler-22.03-LTS-SP4:否

原因说明：
  1.master:
2.openEuler-20.03-LTS-SP4:
3.openEuler-22.03-LTS-SP3:
4.openEuler-22.03-LTS-SP4:
5.openEuler-24.03-LTS:
6.openEuler-24.03-LTS-Next:
7.openEuler-24.03-LTS-SP1:
8.openEuler-24.03-LTS-SP2:

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2024-2367

src-openEuler/kernel
Closed

Content Risk Flag

Comments (7)

src-openEuler/kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2024-50033

Comments (7)

Search

src-openEuler/kernel
Closed