CVE-2024-56628

一、漏洞信息
 漏洞编号：[CVE-2024-56628](https://nvd.nist.gov/vuln/detail/CVE-2024-56628)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.19,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：7.8 High
  Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:LoongArch: Add architecture specific huge_pte_clear()When executing mm selftests run_vmtests.sh, there is such an error: BUG: Bad page state in process uffd-unit-tests  pfn:00000 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x0 flags: 0xffff0000002000(reserved|node=0|zone=0|lastcpupid=0xffff) raw: 00ffff0000002000 ffffbf0000000008 ffffbf0000000008 0000000000000000 raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set Modules linked in: snd_seq_dummy snd_seq snd_seq_device rfkill vfat fat    virtio_balloon efi_pstore virtio_net pstore net_failover failover fuse    nfnetlink virtio_scsi virtio_gpu virtio_dma_buf dm_multipath efivarfs CPU: 2 UID: 0 PID: 1913 Comm: uffd-unit-tests Not tainted 6.12.0 #184 Hardware name: QEMU QEMU Virtual Machine, BIOS unknown 2/2/2022 Stack : 900000047c8ac000 0000000000000000 9000000000223a7c 900000047c8ac000         900000047c8af690 900000047c8af698 0000000000000000 900000047c8af7d8         900000047c8af7d0 900000047c8af7d0 900000047c8af5b0 0000000000000001         0000000000000001 900000047c8af698 10b3c7d53da40d26 0000010000000000         0000000000000022 0000000fffffffff fffffffffe000000 ffff800000000000         000000000000002f 0000800000000000 000000017a6d4000 90000000028f8940         0000000000000000 0000000000000000 90000000025aa5e0 9000000002905000         0000000000000000 90000000028f8940 ffff800000000000 0000000000000000         0000000000000000 0000000000000000 9000000000223a94 000000012001839c         00000000000000b0 0000000000000004 0000000000000000 0000000000071c1d         ... Call Trace: [<9000000000223a94>] show_stack+0x5c/0x180 [<9000000001c3fd64>] dump_stack_lvl+0x6c/0xa0 [<900000000056aa08>] bad_page+0x1a0/0x1f0 [<9000000000574978>] free_unref_folios+0xbf0/0xd20 [<90000000004e65cc>] folios_put_refs+0x1a4/0x2b8 [<9000000000599a0c>] free_pages_and_swap_cache+0x164/0x260 [<9000000000547698>] tlb_batch_pages_flush+0xa8/0x1c0 [<9000000000547f30>] tlb_finish_mmu+0xa8/0x218 [<9000000000543cb8>] exit_mmap+0x1a0/0x360 [<9000000000247658>] __mmput+0x78/0x200 [<900000000025583c>] do_exit+0x43c/0xde8 [<9000000000256490>] do_group_exit+0x68/0x110 [<9000000000256554>] sys_exit_group+0x1c/0x20 [<9000000001c413b4>] do_syscall+0x94/0x130 [<90000000002216d8>] handle_syscall+0xb8/0x158 Disabling lock debugging due to kernel taint BUG: non-zero pgtables_bytes on freeing mm: -16384On LoongArch system, invalid huge pte entry should be invalid_pte_tableor a single _PAGE_HUGE bit rather than a zero value. And it should bethe same with invalid pmd entry, since pmd_none() is called by functionfree_pgd_range() and pmd_none() return 0 by huge_pte_clear(). So single_PAGE_HUGE bit is also treated as a valid pte table and free_pte_range()will be called in free_pmd_range().  free_pmd_range()        pmd = pmd_offset(pud, addr);        do {                next = pmd_addr_end(addr, end);                if (pmd_none_or_clear_bad(pmd))                        continue;                free_pte_range(tlb, pmd, addr);        } while (pmd++, addr = next, addr != end);Here invalid_pte_table is used for both invalid huge pte entry andpmd entry.
 漏洞公开时间：2024-12-27 23:15:22
 漏洞创建时间：2024-12-28 00:03:58
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2024-56628
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/7cd1f5f77925ae905a57296932f0f9ef0dc364f8 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/7dfbf011a57b9e1a40f5ce8080a53c497e105c6c |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/9b602190cf2d8ac957be0011e418ed6c3b49b9a3 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/dba3c45e333a3a2a01395b5f5e5f88f8baba74e4 |  |
| redhat_bugzilla | https://lore.kernel.org/linux-cve-announce/2024122712-CVE-2024-56628-c347@gregkh/T | https://bugzilla.redhat.com/show_bug.cgi?id=2334429 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2024-56628 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

无
</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:LoongArch: Add architecture specific huge_pte_clear()When executing mm selftests run_vmtests.sh, there is such an error: BUG: Bad page state in process uffd-unit-tests  pfn:00000 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x0 flags: 0xffff0000002000(reserved|node=0|zone=0|lastcpupid=0xffff) raw: 00ffff0000002000 ffffbf0000000008 ffffbf0000000008 0000000000000000 raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set Modules linked in: snd_seq_dummy snd_seq snd_seq_device rfkill vfat fat    virtio_balloon efi_pstore virtio_net pstore net_failover failover fuse    nfnetlink virtio_scsi virtio_gpu virtio_dma_buf dm_multipath efivarfs CPU: 2 UID: 0 PID: 1913 Comm: uffd-unit-tests Not tainted 6.12.0 #184 Hardware name: QEMU QEMU Virtual Machine, BIOS unknown 2/2/2022 Stack : 900000047c8ac000 0000000000000000 9000000000223a7c 900000047c8ac000         900000047c8af690 900000047c8af698 0000000000000000 900000047c8af7d8         900000047c8af7d0 900000047c8af7d0 900000047c8af5b0 0000000000000001         0000000000000001 900000047c8af698 10b3c7d53da40d26 0000010000000000         0000000000000022 0000000fffffffff fffffffffe000000 ffff800000000000         000000000000002f 0000800000000000 000000017a6d4000 90000000028f8940         0000000000000000 0000000000000000 90000000025aa5e0 9000000002905000         0000000000000000 90000000028f8940 ffff800000000000 0000000000000000         0000000000000000 0000000000000000 9000000000223a94 000000012001839c         00000000000000b0 0000000000000004 0000000000000000 0000000000071c1d         ... Call Trace: [<9000000000223a94>] show_stack+0x5c/0x180 [<9000000001c3fd64>] dump_stack_lvl+0x6c/0xa0 [<900000000056aa08>] bad_page+0x1a0/0x1f0 [<9000000000574978>] free_unref_folios+0xbf0/0xd20 [<90000000004e65cc>] folios_put_refs+0x1a4/0x2b8 [<9000000000599a0c>] free_pages_and_swap_cache+0x164/0x260 [<9000000000547698>] tlb_batch_pages_flush+0xa8/0x1c0 [<9000000000547f30>] tlb_finish_mmu+0xa8/0x218 [<9000000000543cb8>] exit_mmap+0x1a0/0x360 [<9000000000247658>] __mmput+0x78/0x200 [<900000000025583c>] do_exit+0x43c/0xde8 [<9000000000256490>] do_group_exit+0x68/0x110 [<9000000000256554>] sys_exit_group+0x1c/0x20 [<9000000001c413b4>] do_syscall+0x94/0x130 [<90000000002216d8>] handle_syscall+0xb8/0x158 Disabling lock debugging due to kernel taint BUG: non-zero pgtables_bytes on freeing mm: -16384On LoongArch system, invalid huge pte entry should be invalid_pte_tableor a single _PAGE_HUGE bit rather than a zero value. And it should bethe same with invalid pmd entry, since pmd_none() is called by functionfree_pgd_range() and pmd_none() return 0 by huge_pte_clear(). So single_PAGE_HUGE bit is also treated as a valid pte table and free_pte_range()will be called in free_pmd_range().  free_pmd_range()        pmd = pmd_offset(pud, addr);        do {                next = pmd_addr_end(addr, end);                if (pmd_none_or_clear_bad(pmd))                        continue;                free_pte_range(tlb, pmd, addr);        } while (pmd++, addr = next, addr != end);Here invalid_pte_table is used for both invalid huge pte entry andpmd entry.
 openEuler评分：
  3.9
 Vector：CVSS：3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L
 受影响版本排查(受影响/不受影响)：
  1.openEuler-22.03-LTS-SP3(5.10.0):受影响
2.openEuler-22.03-LTS-SP4(5.10.0):受影响
3.openEuler-24.03-LTS(6.6.0):受影响
4.openEuler-24.03-LTS-SP1(6.6.0):受影响
5.openEuler-20.03-LTS-SP4(4.19.90):不受影响
6.master(6.12.33):不受影响
7.openEuler-24.03-LTS-Next(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP4(4.19.90):否
2.openEuler-22.03-LTS-SP3(5.10.0):否
3.master(6.12.33):否
4.openEuler-24.03-LTS(6.6.0):否
5.openEuler-24.03-LTS-Next(6.6.0):否
6.openEuler-22.03-LTS-SP4(5.10.0):否
7.openEuler-24.03-LTS-SP1(6.6.0):否

原因说明：
  1.openEuler-24.03-LTS(6.6.0):正常修复
2.openEuler-24.03-LTS-SP1(6.6.0):正常修复
3.openEuler-22.03-LTS-SP3(5.10.0):不修复-超出修复范围
4.openEuler-22.03-LTS-SP4(5.10.0):不修复-超出修复范围
5.master(6.12.33):不受影响-漏洞代码不能被攻击者触发
6.openEuler-24.03-LTS-Next(6.6.0):不受影响-漏洞代码不能被攻击者触发
7.openEuler-20.03-LTS-SP4(4.19.90):不受影响-漏洞代码不存在

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2025-1450

src-openEuler / kernel
Closed

Content Risk Flag

Comments (12)

src-openEuler / kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2024-56628

Comments (12)

Search

src-openEuler / kernel
Closed