CVE-2024-50039

一、漏洞信息
 漏洞编号：[CVE-2024-50039](https://nvd.nist.gov/vuln/detail/CVE-2024-50039)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.19,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：5.5 Medium
  Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:net/sched: accept TCA_STAB only for root qdiscMost qdiscs maintain their backlog using qdisc_pkt_len(skb)on the assumption it is invariant between the enqueue()and dequeue() handlers.Unfortunately syzbot can crash a host rather easily usinga TBF + SFQ combination, with an STAB on SFQ [1]We can t support TCA_STAB on arbitrary level, this wouldrequire to maintain per-qdisc storage.[1][   88.796496] BUG: kernel NULL pointer dereference, address: 0000000000000000[   88.798611] #PF: supervisor read access in kernel mode[   88.799014] #PF: error_code(0x0000) - not-present page[   88.799506] PGD 0 P4D 0[   88.799829] Oops: Oops: 0000 [#1] SMP NOPTI[   88.800569] CPU: 14 UID: 0 PID: 2053 Comm: b371744477 Not tainted 6.12.0-rc1-virtme #1117[   88.801107] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014[   88.801779] RIP: 0010:sfq_dequeue (net/sched/sch_sfq.c:272 net/sched/sch_sfq.c:499) sch_sfq[ 88.802544] Code: 0f b7 50 12 48 8d 04 d5 00 00 00 00 48 89 d6 48 29 d0 48 8b 91 c0 01 00 00 48 c1 e0 03 48 01 c2 66 83 7a 1a 00 7e c0 48 8b 3a <4c> 8b 07 4c 89 02 49 89 50 08 48 c7 47 08 00 00 00 00 48 c7 07 00All code========   0:	0f b7 50 12          	movzwl 0x12(%rax),%edx   4:	48 8d 04 d5 00 00 00 	lea    0x0(,%rdx,8),%rax   b:	00   c:	48 89 d6             	mov    %rdx,%rsi   f:	48 29 d0             	sub    %rdx,%rax  12:	48 8b 91 c0 01 00 00 	mov    0x1c0(%rcx),%rdx  19:	48 c1 e0 03          	shl    $0x3,%rax  1d:	48 01 c2             	add    %rax,%rdx  20:	66 83 7a 1a 00       	cmpw   $0x0,0x1a(%rdx)  25:	7e c0                	jle    0xffffffffffffffe7  27:	48 8b 3a             	mov    (%rdx),%rdi  2a:*	4c 8b 07             	mov    (%rdi),%r8		<-- trapping instruction  2d:	4c 89 02             	mov    %r8,(%rdx)  30:	49 89 50 08          	mov    %rdx,0x8(%r8)  34:	48 c7 47 08 00 00 00 	movq   $0x0,0x8(%rdi)  3b:	00  3c:	48                   	rex.W  3d:	c7                   	.byte 0xc7  3e:	07                   	(bad)	...Code starting with the faulting instruction===========================================   0:	4c 8b 07             	mov    (%rdi),%r8   3:	4c 89 02             	mov    %r8,(%rdx)   6:	49 89 50 08          	mov    %rdx,0x8(%r8)   a:	48 c7 47 08 00 00 00 	movq   $0x0,0x8(%rdi)  11:	00  12:	48                   	rex.W  13:	c7                   	.byte 0xc7  14:	07                   	(bad)	...[   88.803721] RSP: 0018:ffff9a1f892b7d58 EFLAGS: 00000206[   88.804032] RAX: 0000000000000000 RBX: ffff9a1f8420c800 RCX: ffff9a1f8420c800[   88.804560] RDX: ffff9a1f81bc1440 RSI: 0000000000000000 RDI: 0000000000000000[   88.805056] RBP: ffffffffc04bb0e0 R08: 0000000000000001 R09: 00000000ff7f9a1f[   88.805473] R10: 000000000001001b R11: 0000000000009a1f R12: 0000000000000140[   88.806194] R13: 0000000000000001 R14: ffff9a1f886df400 R15: ffff9a1f886df4ac[   88.806734] FS:  00007f445601a740(0000) GS:ffff9a2e7fd80000(0000) knlGS:0000000000000000[   88.807225] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033[   88.807672] CR2: 0000000000000000 CR3: 000000050cc46000 CR4: 00000000000006f0[   88.808165] Call Trace:[   88.808459]  <TASK>[   88.808710] ? __die (arch/x86/kernel/dumpstack.c:421 arch/x86/kernel/dumpstack.c:434)[   88.809261] ? page_fault_oops (arch/x86/mm/fault.c:715)[   88.809561] ? exc_page_fault (./arch/x86/include/asm/irqflags.h:26 ./arch/x86/include/asm/irqflags.h:87 ./arch/x86/include/asm/irqflags.h:147 arch/x86/mm/fault.c:1489 arch/x86/mm/fault.c:1539)[   88.809806] ? asm_exc_page_fault (./arch/x86/include/asm/idtentry.h:623)[   88.810074] ? sfq_dequeue (net/sched/sch_sfq.c:272 net/sched/sch_sfq.c:499) sch_sfq[   88.810411] sfq_reset (net/sched/sch_sfq.c:525) sch_sfq[   88.810671] qdisc_reset (./include/linux/skbuff.h:2135 ./include/linux/skbuff.h:2441 ./include/linux/skbuff.h:3304 ./include/linux/skbuff.h:3310 net/sched/sch_g---truncated---
 漏洞公开时间：2024-10-22 04:15:16
 漏洞创建时间：2024-10-22 08:07:29
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2024-50039
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/1edf039ee01788ffc25625fe58a903ae2efa213e |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/2acbb9539bc2284e30d2aeb789c3d96287014264 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/3cb7cf1540ddff5473d6baeb530228d19bc97b8a |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/3dc6ee96473cc2962c6db4297d4631f261be150f |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/76feedc74b90270390fbfdf74a2e944e96872363 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/8fb6503592d39065316f45d267c5527b4e7cd995 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/adbc3eef43fc94c7c8436da832691ae02333a972 |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-50039 | https://bugzilla.suse.com/show_bug.cgi?id=1231909 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2024-50039 | https://bugzilla.suse.com/show_bug.cgi?id=1231909 |
| suse_bugzilla | https://git.kernel.org/stable/c/1edf039ee01788ffc25625fe58a903ae2efa213e | https://bugzilla.suse.com/show_bug.cgi?id=1231909 |
| suse_bugzilla | https://git.kernel.org/stable/c/3cb7cf1540ddff5473d6baeb530228d19bc97b8a | https://bugzilla.suse.com/show_bug.cgi?id=1231909 |
| suse_bugzilla | https://git.kernel.org/stable/c/3dc6ee96473cc2962c6db4297d4631f261be150f | https://bugzilla.suse.com/show_bug.cgi?id=1231909 |
| suse_bugzilla | https://git.kernel.org/stable/c/76feedc74b90270390fbfdf74a2e944e96872363 | https://bugzilla.suse.com/show_bug.cgi?id=1231909 |
| suse_bugzilla | https://git.kernel.org/stable/c/8fb6503592d39065316f45d267c5527b4e7cd995 | https://bugzilla.suse.com/show_bug.cgi?id=1231909 |
| suse_bugzilla | https://git.kernel.org/stable/c/adbc3eef43fc94c7c8436da832691ae02333a972 | https://bugzilla.suse.com/show_bug.cgi?id=1231909 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2024/CVE-2024-50039.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1231909 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2024-50039 |
| anolis |  | https://anas.openanolis.cn/cves/detail/CVE-2024-50039 |
| mageia |  | http://advisories.mageia.org/MGASA-2024-0345.html |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://git.kernel.org/stable/c/1edf039ee01788ffc25625fe58a903ae2efa213e |  | nvd |
|  |  | https://git.kernel.org/stable/c/3cb7cf1540ddff5473d6baeb530228d19bc97b8a |  | nvd |
|  |  | https://git.kernel.org/stable/c/3dc6ee96473cc2962c6db4297d4631f261be150f |  | nvd |
|  |  | https://git.kernel.org/stable/c/76feedc74b90270390fbfdf74a2e944e96872363 |  | nvd |
|  |  | https://git.kernel.org/stable/c/8fb6503592d39065316f45d267c5527b4e7cd995 |  | nvd |
|  |  | https://git.kernel.org/stable/c/adbc3eef43fc94c7c8436da832691ae02333a972 |  | nvd |
| linux_kernel | 5.10.227 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=adbc3eef43fc | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=175f9c1bba9b | linuxkernelcves |
| linux_kernel | 5.15.168 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=8fb6503592d3 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=175f9c1bba9b | linuxkernelcves |
| linux_kernel | 6.1.113 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=76feedc74b90 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=175f9c1bba9b | linuxkernelcves |
| linux_kernel | 6.6.57 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1edf039ee017 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=175f9c1bba9b | linuxkernelcves |
| linux_kernel | 6.11.4 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=3dc6ee96473c | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=175f9c1bba9b | linuxkernelcves |
| linux_kernel | 6.12-rc3 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=3cb7cf1540dd | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=175f9c1bba9b | linuxkernelcves |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:net/sched: accept TCA_STAB only for root qdiscMost qdiscs maintain their backlog using qdisc_pkt_len(skb)on the assumption it is invariant between the enqueue()and dequeue() handlers.Unfortunately syzbot can crash a host rather easily usinga TBF + SFQ combination, with an STAB on SFQ [1]We can t support TCA_STAB on arbitrary level, this wouldrequire to maintain per-qdisc storage.[1][   88.796496] BUG: kernel NULL pointer dereference, address: 0000000000000000[   88.798611] #PF: supervisor read access in kernel mode[   88.799014] #PF: error_code(0x0000) - not-present page[   88.799506] PGD 0 P4D 0[   88.799829] Oops: Oops: 0000 [#1] SMP NOPTI[   88.800569] CPU: 14 UID: 0 PID: 2053 Comm: b371744477 Not tainted 6.12.0-rc1-virtme #1117[   88.801107] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014[   88.801779] RIP: 0010:sfq_dequeue (net/sched/sch_sfq.c:272 net/sched/sch_sfq.c:499) sch_sfq[ 88.802544] Code: 0f b7 50 12 48 8d 04 d5 00 00 00 00 48 89 d6 48 29 d0 48 8b 91 c0 01 00 00 48 c1 e0 03 48 01 c2 66 83 7a 1a 00 7e c0 48 8b 3a <4c> 8b 07 4c 89 02 49 89 50 08 48 c7 47 08 00 00 00 00 48 c7 07 00All code========   0:0f b7 50 12          movzwl 0x12(%rax),%edx   4:48 8d 04 d5 00 00 00 lea    0x0(,%rdx,8),%rax   b:00   c:48 89 d6             mov    %rdx,%rsi   f:48 29 d0             sub    %rdx,%rax  12:48 8b 91 c0 01 00 00 mov    0x1c0(%rcx),%rdx  19:48 c1 e0 03          shl    $0x3,%rax  1d:48 01 c2             add    %rax,%rdx  20:66 83 7a 1a 00       cmpw   $0x0,0x1a(%rdx)  25:7e c0                jle    0xffffffffffffffe7  27:48 8b 3a             mov    (%rdx),%rdi  2a:*4c 8b 07             mov    (%rdi),%r8<-- trapping instruction  2d:4c 89 02             mov    %r8,(%rdx)  30:49 89 50 08          mov    %rdx,0x8(%r8)  34:48 c7 47 08 00 00 00 movq   $0x0,0x8(%rdi)  3b:00  3c:48                   rex.W  3d:c7                   .byte 0xc7  3e:07                   (bad)...Code starting with the faulting instruction===========================================   0:4c 8b 07             mov    (%rdi),%r8   3:4c 89 02             mov    %r8,(%rdx)   6:49 89 50 08          mov    %rdx,0x8(%r8)   a:48 c7 47 08 00 00 00 movq   $0x0,0x8(%rdi)  11:00  12:48                   rex.W  13:c7                   .byte 0xc7  14:07                   (bad)...[   88.803721] RSP: 0018:ffff9a1f892b7d58 EFLAGS: 00000206[   88.804032] RAX: 0000000000000000 RBX: ffff9a1f8420c800 RCX: ffff9a1f8420c800[   88.804560] RDX: ffff9a1f81bc1440 RSI: 0000000000000000 RDI: 0000000000000000[   88.805056] RBP: ffffffffc04bb0e0 R08: 0000000000000001 R09: 00000000ff7f9a1f[   88.805473] R10: 000000000001001b R11: 0000000000009a1f R12: 0000000000000140[   88.806194] R13: 0000000000000001 R14: ffff9a1f886df400 R15: ffff9a1f886df4ac[   88.806734] FS:  00007f445601a740(0000) GS:ffff9a2e7fd80000(0000) knlGS:0000000000000000[   88.807225] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033[   88.807672] CR2: 0000000000000000 CR3: 000000050cc46000 CR4: 00000000000006f0[   88.808165] Call Trace:[   88.808459]  <TASK>[   88.808710] ? __die (arch/x86/kernel/dumpstack.c:421 arch/x86/kernel/dumpstack.c:434)[   88.809261] ? page_fault_oops (arch/x86/mm/fault.c:715)[   88.809561] ? exc_page_fault (./arch/x86/include/asm/irqflags.h:26 ./arch/x86/include/asm/irqflags.h:87 ./arch/x86/include/asm/irqflags.h:147 arch/x86/mm/fault.c:1489 arch/x86/mm/fault.c:1539)[   88.809806] ? asm_exc_page_fault (./arch/x86/include/asm/idtentry.h:623)[   88.810074] ? sfq_dequeue (net/sched/sch_sfq.c:272 net/sched/sch_sfq.c:499) sch_sfq[   88.810411] sfq_reset (net/sched/sch_sfq.c:525) sch_sfq[   88.810671] qdisc_reset (./include/linux/skbuff.h:2135 ./include/linux/skbuff.h:2441 ./include/linux/skbuff.h:3304 ./include/linux/skbuff.h:3310 net/sched/sch_g---truncated---
 openEuler评分：
  5.5
 Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP4(4.19.90):受影响
2.openEuler-22.03-LTS-SP3(5.10.0):受影响
3.openEuler-22.03-LTS-SP4(5.10.0):受影响
4.openEuler-24.03-LTS(6.6.0):受影响
5.openEuler-24.03-LTS-SP1(6.6.0):受影响
6.master(6.6.0):不受影响
7.openEuler-24.03-LTS-Next(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP4(4.19.90):否
2.openEuler-22.03-LTS-SP1(5.10.0):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.master(6.6.0):否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-22.03-LTS-SP4(5.10.0):否
8.openEuler-24.03-LTS-SP1(6.6.0):否

原因说明：
  1.openEuler-22.03-LTS-SP3(5.10.0):正常修复
2.openEuler-22.03-LTS-SP4(5.10.0):正常修复
3.openEuler-24.03-LTS(6.6.0):正常修复
4.openEuler-24.03-LTS-SP1(6.6.0):正常修复
5.openEuler-20.03-LTS-SP4(4.19.90):不修复-超出修复范围
6.master(6.6.0):不受影响-漏洞代码不能被攻击者触发
7.openEuler-24.03-LTS-Next(6.6.0):不受影响-漏洞代码不能被攻击者触发

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2024-2521

src-openEuler/kernel
Closed

Content Risk Flag

Comments (16)

src-openEuler/kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2024-50039

Comments (16)

Search

src-openEuler/kernel
Closed