CVE-2024-50261

一、漏洞信息
 漏洞编号：[CVE-2024-50261](https://nvd.nist.gov/vuln/detail/CVE-2024-50261)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.0,6.1.14,6.1.19,6.1.5,6.1.6,6.1.8,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：7.8 High
  Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:macsec: Fix use-after-free while sending the offloading packetKASAN reports the following UAF. The metadata_dst, which is used tostore the SCI value for macsec offload, is already freed bymetadata_dst_free() in macsec_free_netdev(), while driver still use itfor sending the packet.To fix this issue, dst_release() is used instead to releasemetadata_dst. So it is not freed instantly in macsec_free_netdev() ifstill referenced by skb. BUG: KASAN: slab-use-after-free in mlx5e_xmit+0x1e8f/0x4190 [mlx5_core] Read of size 2 at addr ffff88813e42e038 by task kworker/7:2/714 [...] Workqueue: mld mld_ifc_work Call Trace:  <TASK>  dump_stack_lvl+0x51/0x60  print_report+0xc1/0x600  kasan_report+0xab/0xe0  mlx5e_xmit+0x1e8f/0x4190 [mlx5_core]  dev_hard_start_xmit+0x120/0x530  sch_direct_xmit+0x149/0x11e0  __qdisc_run+0x3ad/0x1730  __dev_queue_xmit+0x1196/0x2ed0  vlan_dev_hard_start_xmit+0x32e/0x510 [8021q]  dev_hard_start_xmit+0x120/0x530  __dev_queue_xmit+0x14a7/0x2ed0  macsec_start_xmit+0x13e9/0x2340  dev_hard_start_xmit+0x120/0x530  __dev_queue_xmit+0x14a7/0x2ed0  ip6_finish_output2+0x923/0x1a70  ip6_finish_output+0x2d7/0x970  ip6_output+0x1ce/0x3a0  NF_HOOK.constprop.0+0x15f/0x190  mld_sendpack+0x59a/0xbd0  mld_ifc_work+0x48a/0xa80  process_one_work+0x5aa/0xe50  worker_thread+0x79c/0x1290  kthread+0x28f/0x350  ret_from_fork+0x2d/0x70  ret_from_fork_asm+0x11/0x20  </TASK> Allocated by task 3922:  kasan_save_stack+0x20/0x40  kasan_save_track+0x10/0x30  __kasan_kmalloc+0x77/0x90  __kmalloc_noprof+0x188/0x400  metadata_dst_alloc+0x1f/0x4e0  macsec_newlink+0x914/0x1410  __rtnl_newlink+0xe08/0x15b0  rtnl_newlink+0x5f/0x90  rtnetlink_rcv_msg+0x667/0xa80  netlink_rcv_skb+0x12c/0x360  netlink_unicast+0x551/0x770  netlink_sendmsg+0x72d/0xbd0  __sock_sendmsg+0xc5/0x190  ____sys_sendmsg+0x52e/0x6a0  ___sys_sendmsg+0xeb/0x170  __sys_sendmsg+0xb5/0x140  do_syscall_64+0x4c/0x100  entry_SYSCALL_64_after_hwframe+0x4b/0x53 Freed by task 4011:  kasan_save_stack+0x20/0x40  kasan_save_track+0x10/0x30  kasan_save_free_info+0x37/0x50  poison_slab_object+0x10c/0x190  __kasan_slab_free+0x11/0x30  kfree+0xe0/0x290  macsec_free_netdev+0x3f/0x140  netdev_run_todo+0x450/0xc70  rtnetlink_rcv_msg+0x66f/0xa80  netlink_rcv_skb+0x12c/0x360  netlink_unicast+0x551/0x770  netlink_sendmsg+0x72d/0xbd0  __sock_sendmsg+0xc5/0x190  ____sys_sendmsg+0x52e/0x6a0  ___sys_sendmsg+0xeb/0x170  __sys_sendmsg+0xb5/0x140  do_syscall_64+0x4c/0x100  entry_SYSCALL_64_after_hwframe+0x4b/0x53
 漏洞公开时间：2024-11-09 19:15:11
 漏洞创建时间：2024-11-09 19:35:56
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2024-50261
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/4614640f1d5c93c22272117dc256e9940ccac8e8 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/872932cf75cf859804370a265dd58118129386fa |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/9f5ae743dbe9a2458540a7d35fff0f990df025cf |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/f1e54d11b210b53d418ff1476c6b58a2f434dfc0 |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-50261 | https://bugzilla.suse.com/show_bug.cgi?id=1233253 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2024/CVE-2024-50261.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1233253 |
| suse_bugzilla | https://git.kernel.org/stable/c/872932cf75cf859804370a265dd58118129386fa | https://bugzilla.suse.com/show_bug.cgi?id=1233253 |
| suse_bugzilla | https://git.kernel.org/stable/c/9f5ae743dbe9a2458540a7d35fff0f990df025cf | https://bugzilla.suse.com/show_bug.cgi?id=1233253 |
| suse_bugzilla | https://git.kernel.org/stable/c/4614640f1d5c93c22272117dc256e9940ccac8e8 | https://bugzilla.suse.com/show_bug.cgi?id=1233253 |
| suse_bugzilla | https://git.kernel.org/stable/c/f1e54d11b210b53d418ff1476c6b58a2f434dfc0 | https://bugzilla.suse.com/show_bug.cgi?id=1233253 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2024-50261 | https://bugzilla.suse.com/show_bug.cgi?id=1233253 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2024-50261 |
| mageia |  | http://advisories.mageia.org/MGASA-2024-0368.html |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://git.kernel.org/stable/c/4614640f1d5c93c22272117dc256e9940ccac8e8 |  | nvd |
|  |  | https://git.kernel.org/stable/c/872932cf75cf859804370a265dd58118129386fa |  | nvd |
|  |  | https://git.kernel.org/stable/c/9f5ae743dbe9a2458540a7d35fff0f990df025cf |  | nvd |
|  |  | https://git.kernel.org/stable/c/f1e54d11b210b53d418ff1476c6b58a2f434dfc0 |  | nvd |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:macsec: Fix use-after-free while sending the offloading packetKASAN reports the following UAF. The metadata_dst, which is used tostore the SCI value for macsec offload, is already freed bymetadata_dst_free() in macsec_free_netdev(), while driver still use itfor sending the packet.To fix this issue, dst_release() is used instead to releasemetadata_dst. So it is not freed instantly in macsec_free_netdev() ifstill referenced by skb. BUG: KASAN: slab-use-after-free in mlx5e_xmit+0x1e8f/0x4190 [mlx5_core] Read of size 2 at addr ffff88813e42e038 by task kworker/7:2/714 [...] Workqueue: mld mld_ifc_work Call Trace:  <TASK>  dump_stack_lvl+0x51/0x60  print_report+0xc1/0x600  kasan_report+0xab/0xe0  mlx5e_xmit+0x1e8f/0x4190 [mlx5_core]  dev_hard_start_xmit+0x120/0x530  sch_direct_xmit+0x149/0x11e0  __qdisc_run+0x3ad/0x1730  __dev_queue_xmit+0x1196/0x2ed0  vlan_dev_hard_start_xmit+0x32e/0x510 [8021q]  dev_hard_start_xmit+0x120/0x530  __dev_queue_xmit+0x14a7/0x2ed0  macsec_start_xmit+0x13e9/0x2340  dev_hard_start_xmit+0x120/0x530  __dev_queue_xmit+0x14a7/0x2ed0  ip6_finish_output2+0x923/0x1a70  ip6_finish_output+0x2d7/0x970  ip6_output+0x1ce/0x3a0  NF_HOOK.constprop.0+0x15f/0x190  mld_sendpack+0x59a/0xbd0  mld_ifc_work+0x48a/0xa80  process_one_work+0x5aa/0xe50  worker_thread+0x79c/0x1290  kthread+0x28f/0x350  ret_from_fork+0x2d/0x70  ret_from_fork_asm+0x11/0x20  </TASK> Allocated by task 3922:  kasan_save_stack+0x20/0x40  kasan_save_track+0x10/0x30  __kasan_kmalloc+0x77/0x90  __kmalloc_noprof+0x188/0x400  metadata_dst_alloc+0x1f/0x4e0  macsec_newlink+0x914/0x1410  __rtnl_newlink+0xe08/0x15b0  rtnl_newlink+0x5f/0x90  rtnetlink_rcv_msg+0x667/0xa80  netlink_rcv_skb+0x12c/0x360  netlink_unicast+0x551/0x770  netlink_sendmsg+0x72d/0xbd0  __sock_sendmsg+0xc5/0x190  ____sys_sendmsg+0x52e/0x6a0  ___sys_sendmsg+0xeb/0x170  __sys_sendmsg+0xb5/0x140  do_syscall_64+0x4c/0x100  entry_SYSCALL_64_after_hwframe+0x4b/0x53 Freed by task 4011:  kasan_save_stack+0x20/0x40  kasan_save_track+0x10/0x30  kasan_save_free_info+0x37/0x50  poison_slab_object+0x10c/0x190  __kasan_slab_free+0x11/0x30  kfree+0xe0/0x290  macsec_free_netdev+0x3f/0x140  netdev_run_todo+0x450/0xc70  rtnetlink_rcv_msg+0x66f/0xa80  netlink_rcv_skb+0x12c/0x360  netlink_unicast+0x551/0x770  netlink_sendmsg+0x72d/0xbd0  __sock_sendmsg+0xc5/0x190  ____sys_sendmsg+0x52e/0x6a0  ___sys_sendmsg+0xeb/0x170  __sys_sendmsg+0xb5/0x140  do_syscall_64+0x4c/0x100  entry_SYSCALL_64_after_hwframe+0x4b/0x53
 openEuler评分：
  7.8
 Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-24.03-LTS(6.6.0):受影响
2.openEuler-20.03-LTS-SP4(4.19.90):不受影响
3.openEuler-22.03-LTS-SP1(5.10.0):不受影响
4.openEuler-22.03-LTS-SP3(5.10.0):不受影响
5.openEuler-22.03-LTS-SP4(5.10.0):不受影响
6.master(6.6.0):不受影响
7.openEuler-24.03-LTS-Next(6.6.0):不受影响
8.openEuler-24.03-LTS-SP1(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP4(4.19.90):否
2.openEuler-22.03-LTS-SP1(5.10.0):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.master(6.6.0):否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-22.03-LTS-SP4(5.10.0):否
8.openEuler-24.03-LTS-SP1(6.6.0):否

原因说明：
  1.openEuler-24.03-LTS(6.6.0):正常修复
2.openEuler-20.03-LTS-SP4(4.19.90):不受影响-漏洞代码不存在
3.openEuler-22.03-LTS-SP1(5.10.0):不受影响-漏洞代码不存在
4.openEuler-22.03-LTS-SP3(5.10.0):不受影响-漏洞代码不存在
5.openEuler-22.03-LTS-SP4(5.10.0):不受影响-漏洞代码不存在
6.master(6.6.0):不受影响-漏洞代码不存在
7.openEuler-24.03-LTS-Next(6.6.0):不受影响-漏洞代码不存在
8.openEuler-24.03-LTS-SP1(6.6.0):不受影响-漏洞代码不存在

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2024-2522

@yangyingliang ,@jiaoff ,@guohaocs2c ,@hanjun-guo ,@woqidaideshi ,@newbeats ,@zhangyi089 ,@colyli ,@thundertown ,@htforge ,@chiqijun ,@lengchao ,@zhujianwei001 ,@kylin-mayukun ,@wangxiongfeng ,@wkfxxx ,@SuperSix173 ,@jentlestea ,@oskernel0719 ,@gasonchen 
**issue处理注意事项:** 
**1. 当前issue受影响的分支提交pr时, 须在pr描述中填写当前issue编号进行关联, 否则无法关闭当前issue;**
**2. 模板内容需要填写完整, 无论是受影响或者不受影响都需要填写完整内容,未引入的分支不需要填写, 否则无法关闭当前issue;**
**3. 以下为模板中需要填写完整的内容, 请复制到评论区回复, 注: 内容的标题名称(影响性分析说明, openEuler评分, 受影响版本排查(受影响/不受影响), 修复是否涉及abi变化(是/否), 原因说明)不能省略,省略后cve-manager将无法正常解析填写内容.**
************************************************************************
影响性分析说明:

openEuler评分: (评分和向量)

受影响版本排查(受影响/不受影响): 
1.master(6.6.0):
2.openEuler-20.03-LTS-SP4(4.19.90):
3.openEuler-22.03-LTS-SP1(5.10.0):
4.openEuler-22.03-LTS-SP3(5.10.0):
5.openEuler-22.03-LTS-SP4(5.10.0):
6.openEuler-24.03-LTS(6.6.0):
7.openEuler-24.03-LTS-Next(6.6.0):

修复是否涉及abi变化(是/否)：
1.master(6.6.0):
2.openEuler-20.03-LTS-SP4(4.19.90):
3.openEuler-22.03-LTS-SP1(5.10.0):
4.openEuler-22.03-LTS-SP3(5.10.0):
5.openEuler-22.03-LTS-SP4(5.10.0):
6.openEuler-24.03-LTS(6.6.0):
7.openEuler-24.03-LTS-Next(6.6.0):

原因说明：
1.master(6.6.0):
2.openEuler-20.03-LTS-SP4(4.19.90):
3.openEuler-22.03-LTS-SP1(5.10.0):
4.openEuler-22.03-LTS-SP3(5.10.0):
5.openEuler-22.03-LTS-SP4(5.10.0):
6.openEuler-24.03-LTS(6.6.0):
7.openEuler-24.03-LTS-Next(6.6.0):

issue处理具体操作请参考: 
https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
pr关联issue具体操作请参考:
https://gitee.com/help/articles/4142

CVE-2024-50261

影响性分析说明：
In the Linux kernel, the following vulnerability has been resolved:

macsec: Fix use-after-free while sending the offloading packet

KASAN reports the following UAF. The metadata_dst, which is used to
store the SCI value for macsec offload, is already freed by
metadata_dst_free() in macsec_free_netdev(), while driver still use it
for sending the packet.

To fix this issue, dst_release() is used instead to release
metadata_dst. So it is not freed instantly in macsec_free_netdev() if
still referenced by skb.

BUG: KASAN: slab-use-after-free in mlx5e_xmit+0x1e8f/0x4190 [mlx5_core]
 Read of size 2 at addr ffff88813e42e038 by task kworker/7:2/714
 [...]
 Workqueue: mld mld_ifc_work
 Call Trace:
  &lt;TASK&gt;
  dump_stack_lvl+0x51/0x60
  print_report+0xc1/0x600
  kasan_report+0xab/0xe0
  mlx5e_xmit+0x1e8f/0x4190 [mlx5_core]
  dev_hard_start_xmit+0x120/0x530
  sch_direct_xmit+0x149/0x11e0
  __qdisc_run+0x3ad/0x1730
  __dev_queue_xmit+0x1196/0x2ed0
  vlan_dev_hard_start_xmit+0x32e/0x510 [8021q]
  dev_hard_start_xmit+0x120/0x530
  __dev_queue_xmit+0x14a7/0x2ed0
  macsec_start_xmit+0x13e9/0x2340
  dev_hard_start_xmit+0x120/0x530
  __dev_queue_xmit+0x14a7/0x2ed0
  ip6_finish_output2+0x923/0x1a70
  ip6_finish_output+0x2d7/0x970
  ip6_output+0x1ce/0x3a0
  NF_HOOK.constprop.0+0x15f/0x190
  mld_sendpack+0x59a/0xbd0
  mld_ifc_work+0x48a/0xa80
  process_one_work+0x5aa/0xe50
  worker_thread+0x79c/0x1290
  kthread+0x28f/0x350
  ret_from_fork+0x2d/0x70
  ret_from_fork_asm+0x11/0x20
  &lt;/TASK&gt;

Allocated by task 3922:
  kasan_save_stack+0x20/0x40
  kasan_save_track+0x10/0x30
  __kasan_kmalloc+0x77/0x90
  __kmalloc_noprof+0x188/0x400
  metadata_dst_alloc+0x1f/0x4e0
  macsec_newlink+0x914/0x1410
  __rtnl_newlink+0xe08/0x15b0
  rtnl_newlink+0x5f/0x90
  rtnetlink_rcv_msg+0x667/0xa80
  netlink_rcv_skb+0x12c/0x360
  netlink_unicast+0x551/0x770
  netlink_sendmsg+0x72d/0xbd0
  __sock_sendmsg+0xc5/0x190
  ____sys_sendmsg+0x52e/0x6a0
  ___sys_sendmsg+0xeb/0x170
  __sys_sendmsg+0xb5/0x140
  do_syscall_64+0x4c/0x100
  entry_SYSCALL_64_after_hwframe+0x4b/0x53

Freed by task 4011:
  kasan_save_stack+0x20/0x40
  kasan_save_track+0x10/0x30
  kasan_save_free_info+0x37/0x50
  poison_slab_object+0x10c/0x190
  __kasan_slab_free+0x11/0x30
  kfree+0xe0/0x290
  macsec_free_netdev+0x3f/0x140
  netdev_run_todo+0x450/0xc70
  rtnetlink_rcv_msg+0x66f/0xa80
  netlink_rcv_skb+0x12c/0x360
  netlink_unicast+0x551/0x770
  netlink_sendmsg+0x72d/0xbd0
  __sock_sendmsg+0xc5/0x190
  ____sys_sendmsg+0x52e/0x6a0
  ___sys_sendmsg+0xeb/0x170
  __sys_sendmsg+0xb5/0x140
  do_syscall_64+0x4c/0x100
  entry_SYSCALL_64_after_hwframe+0x4b/0x53

The Linux kernel CVE team has assigned CVE-2024-50261 to this issue.

openEuler评分:(评分和向量)
7.8
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

受影响版本排查(受影响/不受影响):
1.openEuler-20.03-LTS-SP4:不受影响
2.openEuler-22.03-LTS-SP1:不受影响
3.openEuler-22.03-LTS-SP3:不受影响
4.openEuler-22.03-LTS-SP4:不受影响
5.master(6.1.0):不受影响
6.openEuler-24.03-LTS:受影响
7.openEuler-24.03-LTS-Next:不受影响

修复是否涉及abi变化(是/否)：
1.openEuler-20.03-LTS-SP4:否
2.openEuler-22.03-LTS-SP1:否
3.openEuler-22.03-LTS-SP3:否
4.master(6.1.0):否
5.openEuler-24.03-LTS:否
6.openEuler-24.03-LTS-Next:否
7.openEuler-22.03-LTS-SP4:否