CVE-2024-50200

一、漏洞信息
 漏洞编号：[CVE-2024-50200](https://nvd.nist.gov/vuln/detail/CVE-2024-50200)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.19,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：5.5 Medium
  Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:maple_tree: correct tree corruption on spanning storePatch series  maple_tree: correct tree corruption on spanning store , v3.There has been a nasty yet subtle maple tree corruption bug that appearsto have been in existence since the inception of the algorithm.This bug seems far more likely to happen since commit f8d112a4e657( mm/mmap: avoid zeroing vma tree in mmap_region() ), which is the pointat which reports started to be submitted concerning this bug.We were made definitely aware of the bug thanks to the kind efforts ofBert Karwatzki who helped enormously in my being able to track this downand identify the cause of it.The bug arises when an attempt is made to perform a spanning store acrosstwo leaf nodes, where the right leaf node is the rightmost child of theshared parent, AND the store completely consumes the right-mode node.This results in mas_wr_spanning_store() mitakenly duplicating the new andexisting entries at the maximum pivot within the range, and thus mapletree corruption.The fix patch corrects this by detecting this scenario and disallowing themistaken duplicate copy.The fix patch commit message goes into great detail as to how this occurs.This series also includes a test which reliably reproduces the issue, andasserts that the fix works correctly.Bert has kindly tested the fix and confirmed it resolved his issues.  AlsoMikhail Gavrilov kindly reported what appears to be precisely the samebug, which this fix should also resolve.This patch (of 2):There has been a subtle bug present in the maple tree implementation fromits inception.This arises from how stores are performed - when a store occurs, it willoverwrite overlapping ranges and adjust the tree as necessary toaccommodate this.A range may always ultimately span two leaf nodes.  In this instance wewalk the two leaf nodes, determine which elements are not overwritten tothe left and to the right of the start and end of the ranges respectivelyand then rebalance the tree to contain these entries and the newlyinserted one.This kind of store is dubbed a  spanning store  and is implemented bymas_wr_spanning_store().In order to reach this stage, mas_store_gfp() invokesmas_wr_preallocate(), mas_wr_store_type() and mas_wr_walk() in turn towalk the tree and update the object (mas) to traverse to the locationwhere the write should be performed, determining its store type.When a spanning store is required, this function returns false stopping atthe parent node which contains the target range, and mas_wr_store_type()marks the mas->store_type as wr_spanning_store to denote this fact.When we go to perform the store in mas_wr_spanning_store(), we firstdetermine the elements AFTER the END of the range we wish to store (thatis, to the right of the entry to be inserted) - we do this by walking tothe NEXT pivot in the tree (i.e.  r_mas.last + 1), starting at the node wehave just determined contains the range over which we intend to write.We then turn our attention to the entries to the left of the entry we areinserting, whose state is represented by l_mas, and copy these into a  bignode , which is a special node which contains enough slots to contain twoleaf node s worth of data.We then copy the entry we wish to store immediately after this - the copyand the insertion of the new entry is performed by mas_store_b_node().After this we copy the elements to the right of the end of the range whichwe are inserting, if we have not exceeded the length of the node (i.e. r_mas.offset <= r_mas.end).Herein lies the bug - under very specific circumstances, this logic canbreak and corrupt the maple tree.Consider the following tree:Height  0                             Root Node                                 /                        pivot = 0xffff /          pivot = ULONG_MAX                               /          ---truncated---
 漏洞公开时间：2024-11-08 14:15:16
 漏洞创建时间：2024-11-08 14:34:23
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2024-50200
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/677f1df179cb68c12ddf7707ec325eb50e99c7d9 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/7c7874977da9e47ca0f53d8b9a5b17385fed83f2 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/982dd0d26d1f015ed34866579480d2be5250b0ef |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/bea07fd63192b61209d48cbb81ef474cc3ee4c62 |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-50200 | https://bugzilla.suse.com/show_bug.cgi?id=1233088 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2024-50200 | https://bugzilla.suse.com/show_bug.cgi?id=1233088 |
| suse_bugzilla | https://git.kernel.org/stable/c/677f1df179cb68c12ddf7707ec325eb50e99c7d9 | https://bugzilla.suse.com/show_bug.cgi?id=1233088 |
| suse_bugzilla | https://git.kernel.org/stable/c/7c7874977da9e47ca0f53d8b9a5b17385fed83f2 | https://bugzilla.suse.com/show_bug.cgi?id=1233088 |
| suse_bugzilla | https://git.kernel.org/stable/c/982dd0d26d1f015ed34866579480d2be5250b0ef | https://bugzilla.suse.com/show_bug.cgi?id=1233088 |
| suse_bugzilla | https://git.kernel.org/stable/c/bea07fd63192b61209d48cbb81ef474cc3ee4c62 | https://bugzilla.suse.com/show_bug.cgi?id=1233088 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2024/CVE-2024-50200.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1233088 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2024-50200 |
| anolis |  | https://anas.openanolis.cn/cves/detail/CVE-2024-50200 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

无
</details>

二、漏洞分析结构反馈
 影响性分析说明：
  Reserved.
 openEuler评分：
  5.5
 Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-24.03-LTS(6.6.0):受影响
2.openEuler-24.03-LTS-SP1(6.6.0):受影响
3.openEuler-20.03-LTS-SP4(4.19.90):不受影响
4.openEuler-22.03-LTS-SP3(5.10.0):不受影响
5.openEuler-22.03-LTS-SP4(5.10.0):不受影响
6.master(6.12.33):不受影响
7.openEuler-24.03-LTS-Next(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP4(4.19.90):否
2.openEuler-22.03-LTS-SP1(5.10.0):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.master(6.12.33):否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-22.03-LTS-SP4(5.10.0):否
8.openEuler-24.03-LTS-SP1(6.6.0):否

原因说明：
  1.openEuler-24.03-LTS(6.6.0):正常修复
2.openEuler-24.03-LTS-SP1(6.6.0):正常修复
3.master(6.12.33):不受影响-漏洞代码不能被攻击者触发
4.openEuler-24.03-LTS-Next(6.6.0):不受影响-漏洞代码不能被攻击者触发
5.openEuler-20.03-LTS-SP4(4.19.90):不受影响-漏洞代码不存在
6.openEuler-22.03-LTS-SP3(5.10.0):不受影响-漏洞代码不存在
7.openEuler-22.03-LTS-SP4(5.10.0):不受影响-漏洞代码不存在

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2024-2537

src-openEuler/kernel
Closed

Content Risk Flag

Comments (13)

src-openEuler/kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2024-50200

Comments (13)

Search

src-openEuler/kernel
Closed