CVE-2024-56702

一、漏洞信息
 漏洞编号：[CVE-2024-56702](https://nvd.nist.gov/vuln/detail/CVE-2024-56702)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.19,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：0.0 None
  Vector：CVSS：3.0/
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:bpf: Mark raw_tp arguments with PTR_MAYBE_NULLArguments to a raw tracepoint are tagged as trusted, which carries thesemantics that the pointer will be non-NULL.  However, in certain cases,a raw tracepoint argument may end up being NULL. More context about thisissue is available in [0].Thus, there is a discrepancy between the reality, that raw_tp argumentscan actually be NULL, and the verifier s knowledge, that they are neverNULL, causing explicit NULL checks to be deleted, and accesses to suchpointers potentially crashing the kernel.To fix this, mark raw_tp arguments as PTR_MAYBE_NULL, and then specialcase the dereference and pointer arithmetic to permit it, and allowpassing them into helpers/kfuncs; these exceptions are made for raw_tpprograms only. Ensure that we don t do this when ref_obj_id > 0, as inthat case this is an acquired object and doesn t need such adjustment.The reason we do mask_raw_tp_trusted_reg logic is because other willrecheck in places whether the register is a trusted_reg, and thenconsider our register as untrusted when detecting the presence of thePTR_MAYBE_NULL flag.To allow safe dereference, we enable PROBE_MEM marking when we see loadsinto trusted pointers with PTR_MAYBE_NULL.While trusted raw_tp arguments can also be passed into helpers or kfuncswhere such broken assumption may cause issues, a future patch set willtackle their case separately, as PTR_TO_BTF_ID (without PTR_TRUSTED) canalready be passed into helpers and causes similar problems. Thus, theyare left alone for now.It is possible that these checks also permit passing non-raw_tp argsthat are trusted PTR_TO_BTF_ID with null marking. In such a case,allowing dereference when pointer is NULL expands allowed behavior, sowon t regress existing programs, and the case of passing these intohelpers is the same as above and will be dealt with later.Also update the failure case in tp_btf_nullable selftest to capture thenew behavior, as the verifier will no longer cause an error whendirectly dereference a raw tracepoint argument marked as __nullable.  [0]: https://lore.kernel.org/bpf/ZrCZS6nisraEqehw@jlelli-thinkpadt14gen4.remote.csb
 漏洞公开时间：2024-12-28 18:15:17
 漏洞创建时间：2024-12-28 18:32:45
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2024-56702
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/3634d4a310820567fc634bf8f1ee2b91378773e8 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/c9b91d2d54175f781ad2c361cb2ac2c0e29b14b6 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/cb4158ce8ec8a5bb528cc1693356a5eb8058094d |  |
| redhat_bugzilla | https://lore.kernel.org/bpf/ZrCZS6nisraEqehw@jlelli-thinkpadt14gen4.remote.csb | https://bugzilla.redhat.com/show_bug.cgi?id=2334670 |
| redhat_bugzilla | https://lore.kernel.org/linux-cve-announce/2024122837-CVE-2024-56702-172d@gregkh/T | https://bugzilla.redhat.com/show_bug.cgi?id=2334670 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2024-56702 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

无
</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:bpf: Mark raw_tp arguments with PTR_MAYBE_NULLArguments to a raw tracepoint are tagged as trusted, which carries thesemantics that the pointer will be non-NULL.  However, in certain cases,a raw tracepoint argument may end up being NULL. More context about thisissue is available in [0].Thus, there is a discrepancy between the reality, that raw_tp argumentscan actually be NULL, and the verifier&#39;s knowledge, that they are neverNULL, causing explicit NULL checks to be deleted, and accesses to suchpointers potentially crashing the kernel.To fix this, mark raw_tp arguments as PTR_MAYBE_NULL, and then specialcase the dereference and pointer arithmetic to permit it, and allowpassing them into helpers/kfuncs; these exceptions are made for raw_tpprograms only. Ensure that we don&#39;t do this when ref_obj_id &gt; 0, as inthat case this is an acquired object and doesn&#39;t need such adjustment.The reason we do mask_raw_tp_trusted_reg logic is because other willrecheck in places whether the register is a trusted_reg, and thenconsider our register as untrusted when detecting the presence of thePTR_MAYBE_NULL flag.To allow safe dereference, we enable PROBE_MEM marking when we see loadsinto trusted pointers with PTR_MAYBE_NULL.While trusted raw_tp arguments can also be passed into helpers or kfuncswhere such broken assumption may cause issues, a future patch set willtackle their case separately, as PTR_TO_BTF_ID (without PTR_TRUSTED) canalready be passed into helpers and causes similar problems. Thus, theyare left alone for now.It is possible that these checks also permit passing non-raw_tp argsthat are trusted PTR_TO_BTF_ID with null marking. In such a case,allowing dereference when pointer is NULL expands allowed behavior, sowon&#39;t regress existing programs, and the case of passing these intohelpers is the same as above and will be dealt with later.Also update the failure case in tp_btf_nullable selftest to capture thenew behavior, as the verifier will no longer cause an error whendirectly dereference a raw tracepoint argument marked as __nullable.  [0]: <ahref= https://lore.kernel.org/bpf/ZrCZS6nisraEqehw@jlelli-thinkpadt14gen4.remote.csb >https://lore.kernel.org/bpf/ZrCZS6nisraEqehw@jlelli-thinkpadt14gen4.remote.csb</a>The Linux kernel CVE team has assigned CVE-2024-56702 to this issue.
 openEuler评分：
  5.5
 Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-24.03-LTS:受影响
2.openEuler-24.03-LTS-SP1:受影响
3.openEuler-20.03-LTS-SP4(4.19.90):不受影响
4.openEuler-22.03-LTS-SP1:不受影响
5.openEuler-22.03-LTS-SP3:不受影响
6.openEuler-22.03-LTS-SP4:不受影响
7.master:不受影响
8.openEuler-24.03-LTS-Next:不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP4(4.19.90):否
2.openEuler-22.03-LTS-SP1:否
3.openEuler-22.03-LTS-SP3:否
4.master:否
5.openEuler-24.03-LTS:否
6.openEuler-24.03-LTS-Next:否
7.openEuler-22.03-LTS-SP4:否
8.openEuler-24.03-LTS-SP1:否

原因说明：
  1.openEuler-24.03-LTS:正常修复
2.openEuler-24.03-LTS-SP1:正常修复
3.master:不受影响-漏洞代码不能被攻击者触发
4.openEuler-24.03-LTS-Next:不受影响-漏洞代码不能被攻击者触发
5.openEuler-20.03-LTS-SP4(4.19.90):不受影响-漏洞代码不存在
6.openEuler-22.03-LTS-SP1:不受影响-漏洞代码不存在
7.openEuler-22.03-LTS-SP3:不受影响-漏洞代码不存在
8.openEuler-22.03-LTS-SP4:不受影响-漏洞代码不存在

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2025-1036

src-openEuler/kernel
Closed

Content Risk Flag

Comments (7)

src-openEuler/kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2024-56702

Comments (7)

Search

src-openEuler/kernel
Closed