CVE-2024-50194

一、漏洞信息
 漏洞编号：[CVE-2024-50194](https://nvd.nist.gov/vuln/detail/CVE-2024-50194)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.0,6.1.14,6.1.19,6.1.5,6.1.6,6.1.8,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：5.5 Medium
  Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:arm64: probes: Fix uprobes for big-endian kernelsThe arm64 uprobes code is broken for big-endian kernels as it doesn tconvert the in-memory instruction encoding (which is alwayslittle-endian) into the kernel s native endianness before analyzing andsimulating instructions. This may result in a few distinct problems:* The kernel may may erroneously reject probing an instruction which can  safely be probed.* The kernel may erroneously erroneously permit stepping an  instruction out-of-line when that instruction cannot be stepped  out-of-line safely.* The kernel may erroneously simulate instruction incorrectly dur to  interpretting the byte-swapped encoding.The endianness mismatch isn t caught by the compiler or sparse because:* The arch_uprobe::{insn,ixol} fields are encoded as arrays of u8, so  the compiler and sparse have no idea these contain a little-endian  32-bit value. The core uprobes code populates these with a memcpy()  which similarly does not handle endianness.* While the uprobe_opcode_t type is an alias for __le32, both  arch_uprobe_analyze_insn() and arch_uprobe_skip_sstep() cast from u8[]  to the similarly-named probe_opcode_t, which is an alias for u32.  Hence there is no endianness conversion warning.Fix this by changing the arch_uprobe::{insn,ixol} fields to __le32 andadding the appropriate __le32_to_cpu() conversions prior to consumingthe instruction encoding. The core uprobes copies these fields as opaqueranges of bytes, and so is unaffected by this change.At the same time, remove MAX_UINSN_BYTES and consistently useAARCH64_INSN_SIZE for clarity.Tested with the following:| #include <stdio.h>| #include <stdbool.h>|| #define noinline __attribute__((noinline))|| static noinline void *adrp_self(void)| {|         void *addr;||         asm volatile(|                 adrp    %x0, adrp_self n |                 add     %x0, %x0, :lo12:adrp_self n |         :  =r  (addr));| }||| int main(int argc, char *argv)| {|         void *ptr = adrp_self();|         bool equal = (ptr == adrp_self);||         printf( adrp_self   => %p n |                 adrp_self() => %p n |                 %s n ,|                adrp_self, ptr, equal ?  EQUAL  :  NOT EQUAL );||         return 0;| }.... where the adrp_self() function was compiled to:| 00000000004007e0 <adrp_self>:|   4007e0:       90000000        adrp    x0, 400000 <__ehdr_start>|   4007e4:       911f8000        add     x0, x0, #0x7e0|   4007e8:       d65f03c0        retBefore this patch, the ADRP is not recognized, and is assumed to besteppable, resulting in corruption of the result:| # ./adrp-self| adrp_self   => 0x4007e0| adrp_self() => 0x4007e0| EQUAL| # echo  p /root/adrp-self:0x007e0  > /sys/kernel/tracing/uprobe_events| # echo 1 > /sys/kernel/tracing/events/uprobes/enable| # ./adrp-self| adrp_self   => 0x4007e0| adrp_self() => 0xffffffffff7e0| NOT EQUALAfter this patch, the ADRP is correctly recognized and simulated:| # ./adrp-self| adrp_self   => 0x4007e0| adrp_self() => 0x4007e0| EQUAL| #| # echo  p /root/adrp-self:0x007e0  > /sys/kernel/tracing/uprobe_events| # echo 1 > /sys/kernel/tracing/events/uprobes/enable| # ./adrp-self| adrp_self   => 0x4007e0| adrp_self() => 0x4007e0| EQUAL
 漏洞公开时间：2024-11-08 14:15:16
 漏洞创建时间：2024-11-15 17:24:03
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2024-50194
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/13f8f1e05f1dc36dbba6cba0ae03354c0dafcde7 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/14841bb7a531b96e2dde37423a3b33e75147c60d |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/3d2530c65be04e93720e30f191a7cf1a3aa8b51c |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/8165bf83b8a64be801d59cd2532b0d1ffed74d00 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/b6a638cb600e13f94b5464724eaa6ab7f3349ca2 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/cf60d19d40184e43d9a624e55a0da73be09e938d |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/cf9ddf9ed94c15564a05bbf6e9f18dffa0c7df80 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/e6ab336213918575124d6db43dc5d3554526242e |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-50194 | https://bugzilla.suse.com/show_bug.cgi?id=1233111 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2024-50194 | https://bugzilla.suse.com/show_bug.cgi?id=1233111 |
| suse_bugzilla | https://git.kernel.org/stable/c/13f8f1e05f1dc36dbba6cba0ae03354c0dafcde7 | https://bugzilla.suse.com/show_bug.cgi?id=1233111 |
| suse_bugzilla | https://git.kernel.org/stable/c/14841bb7a531b96e2dde37423a3b33e75147c60d | https://bugzilla.suse.com/show_bug.cgi?id=1233111 |
| suse_bugzilla | https://git.kernel.org/stable/c/3d2530c65be04e93720e30f191a7cf1a3aa8b51c | https://bugzilla.suse.com/show_bug.cgi?id=1233111 |
| suse_bugzilla | https://git.kernel.org/stable/c/8165bf83b8a64be801d59cd2532b0d1ffed74d00 | https://bugzilla.suse.com/show_bug.cgi?id=1233111 |
| suse_bugzilla | https://git.kernel.org/stable/c/cf60d19d40184e43d9a624e55a0da73be09e938d | https://bugzilla.suse.com/show_bug.cgi?id=1233111 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2024/CVE-2024-50194.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1233111 |
| redhat_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-50194.mbox | https://bugzilla.redhat.com/show_bug.cgi?id=2324643 |
| redhat_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/ | https://bugzilla.redhat.com/show_bug.cgi?id=2324643 |
| redhat_bugzilla | https://geometrydashlite.online | https://bugzilla.redhat.com/show_bug.cgi?id=2324643 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2024-50194 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  其它
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://git.kernel.org/stable/c/13f8f1e05f1dc36dbba6cba0ae03354c0dafcde7 |  | nvd |
|  |  | https://git.kernel.org/stable/c/14841bb7a531b96e2dde37423a3b33e75147c60d |  | nvd |
|  |  | https://git.kernel.org/stable/c/3d2530c65be04e93720e30f191a7cf1a3aa8b51c |  | nvd |
|  |  | https://git.kernel.org/stable/c/8165bf83b8a64be801d59cd2532b0d1ffed74d00 |  | nvd |
|  |  | https://git.kernel.org/stable/c/b6a638cb600e13f94b5464724eaa6ab7f3349ca2 |  | nvd |
|  |  | https://git.kernel.org/stable/c/cf60d19d40184e43d9a624e55a0da73be09e938d |  | nvd |
|  |  | https://git.kernel.org/stable/c/cf9ddf9ed94c15564a05bbf6e9f18dffa0c7df80 |  | nvd |
|  |  | https://git.kernel.org/stable/c/e6ab336213918575124d6db43dc5d3554526242e |  | nvd |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:arm64: probes: Fix uprobes for big-endian kernelsThe arm64 uprobes code is broken for big-endian kernels as it doesn tconvert the in-memory instruction encoding (which is alwayslittle-endian) into the kernel s native endianness before analyzing andsimulating instructions. This may result in a few distinct problems:* The kernel may may erroneously reject probing an instruction which can  safely be probed.* The kernel may erroneously erroneously permit stepping an  instruction out-of-line when that instruction cannot be stepped  out-of-line safely.* The kernel may erroneously simulate instruction incorrectly dur to  interpretting the byte-swapped encoding.The endianness mismatch isn t caught by the compiler or sparse because:* The arch_uprobe::{insn,ixol} fields are encoded as arrays of u8, so  the compiler and sparse have no idea these contain a little-endian  32-bit value. The core uprobes code populates these with a memcpy()  which similarly does not handle endianness.* While the uprobe_opcode_t type is an alias for __le32, both  arch_uprobe_analyze_insn() and arch_uprobe_skip_sstep() cast from u8[]  to the similarly-named probe_opcode_t, which is an alias for u32.  Hence there is no endianness conversion warning.Fix this by changing the arch_uprobe::{insn,ixol} fields to __le32 andadding the appropriate __le32_to_cpu() conversions prior to consumingthe instruction encoding. The core uprobes copies these fields as opaqueranges of bytes, and so is unaffected by this change.At the same time, remove MAX_UINSN_BYTES and consistently useAARCH64_INSN_SIZE for clarity.Tested with the following:| #include <stdio.h>| #include <stdbool.h>|| #define noinline __attribute__((noinline))|| static noinline void *adrp_self(void)| {|         void *addr;||         asm volatile(|                 adrp    %x0, adrp_self n |                 add     %x0, %x0, :lo12:adrp_self n |         :  =r  (addr));| }||| int main(int argc, char *argv)| {|         void *ptr = adrp_self();|         bool equal = (ptr == adrp_self);||         printf( adrp_self   => %p n |                 adrp_self() => %p n |                 %s n ,|                adrp_self, ptr, equal ?  EQUAL  :  NOT EQUAL );||         return 0;| }.... where the adrp_self() function was compiled to:| 00000000004007e0 <adrp_self>:|   4007e0:       90000000        adrp    x0, 400000 <__ehdr_start>|   4007e4:       911f8000        add     x0, x0, #0x7e0|   4007e8:       d65f03c0        retBefore this patch, the ADRP is not recognized, and is assumed to besteppable, resulting in corruption of the result:| # ./adrp-self| adrp_self   => 0x4007e0| adrp_self() => 0x4007e0| EQUAL| # echo  p /root/adrp-self:0x007e0  > /sys/kernel/tracing/uprobe_events| # echo 1 > /sys/kernel/tracing/events/uprobes/enable| # ./adrp-self| adrp_self   => 0x4007e0| adrp_self() => 0xffffffffff7e0| NOT EQUALAfter this patch, the ADRP is correctly recognized and simulated:| # ./adrp-self| adrp_self   => 0x4007e0| adrp_self() => 0x4007e0| EQUAL| #| # echo  p /root/adrp-self:0x007e0  > /sys/kernel/tracing/uprobe_events| # echo 1 > /sys/kernel/tracing/events/uprobes/enable| # ./adrp-self| adrp_self   => 0x4007e0| adrp_self() => 0x4007e0| EQUAL
 openEuler评分：
  5.5
 Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP4(4.19.90):受影响
2.openEuler-22.03-LTS-SP3(5.10.0):受影响
3.openEuler-22.03-LTS-SP4(5.10.0):受影响
4.openEuler-24.03-LTS(6.6.0):受影响
5.openEuler-24.03-LTS-SP1(6.6.0):受影响
6.master(6.6.0):不受影响
7.openEuler-24.03-LTS-Next(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP4(4.19.90):否
2.openEuler-22.03-LTS-SP3(5.10.0):否
3.master(6.6.0):否
4.openEuler-24.03-LTS(6.6.0):否
5.openEuler-24.03-LTS-Next(6.6.0):否
6.openEuler-22.03-LTS-SP4(5.10.0):否
7.openEuler-24.03-LTS-SP1(6.6.0):否

原因说明：
  1.openEuler-20.03-LTS-SP4(4.19.90):正常修复
2.openEuler-24.03-LTS(6.6.0):正常修复
3.openEuler-24.03-LTS-SP1(6.6.0):正常修复
4.openEuler-22.03-LTS-SP3(5.10.0):不修复-超出修复范围
5.openEuler-22.03-LTS-SP4(5.10.0):不修复-超出修复范围
6.master(6.6.0):不受影响-漏洞代码不能被攻击者触发
7.openEuler-24.03-LTS-Next(6.6.0):不受影响-漏洞代码不能被攻击者触发

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2025-1096

src-openEuler/kernel
Closed

Content Risk Flag

Comments (20)

src-openEuler/kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2024-50194

Comments (20)

Search

src-openEuler/kernel
Closed