CVE-2024-56770

一、漏洞信息
 漏洞编号：[CVE-2024-56770](https://nvd.nist.gov/vuln/detail/CVE-2024-56770)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.19,6.1.8,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：5.5 Medium
  Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:net/sched: netem: account for backlog updates from child qdiscIn general,  qlen  of any classful qdisc should keep track of thenumber of packets that the qdisc itself and all of its children holds.In case of netem,  qlen  only accounts for the packets in its internaltfifo. When netem is used with a child qdisc, the child qdisc can use qdisc_tree_reduce_backlog  to inform its parent, netem, about createdor dropped SKBs. This function updates  qlen  and the backlog statisticsof netem, but netem does not account for changes made by a child qdisc. qlen  then indicates the wrong number of packets in the tfifo.If a child qdisc creates new SKBs during enqueue and informs its parentabout this, netem s  qlen  value is increased. When netem dequeues thenewly created SKBs from the child, the  qlen  in netem is not updated.If  qlen  reaches the configured sch->limit, the enqueue function stopsworking, even though the tfifo is not full.Reproduce the bug:Ensure that the sender machine has GSO enabled. Configure netem as rootqdisc and tbf as its child on the outgoing interface of the machineas follows:$ tc qdisc add dev <oif> root handle 1: netem delay 100ms limit 100$ tc qdisc add dev <oif> parent 1:0 tbf rate 50Mbit burst 1542 latency 50msSend bulk TCP traffic out via this interface, e.g., by running an iPerf3client on the machine. Check the qdisc statistics:$ tc -s qdisc show dev <oif>Statistics after 10s of iPerf3 TCP test before the fix (note thatnetem s backlog > limit, netem stopped accepting packets):qdisc netem 1: root refcnt 2 limit 1000 delay 100ms Sent 2767766 bytes 1848 pkt (dropped 652, overlimits 0 requeues 0) backlog 4294528236b 1155p requeues 0qdisc tbf 10: parent 1:1 rate 50Mbit burst 1537b lat 50ms Sent 2767766 bytes 1848 pkt (dropped 327, overlimits 7601 requeues 0) backlog 0b 0p requeues 0Statistics after the fix:qdisc netem 1: root refcnt 2 limit 1000 delay 100ms Sent 37766372 bytes 24974 pkt (dropped 9, overlimits 0 requeues 0) backlog 0b 0p requeues 0qdisc tbf 10: parent 1:1 rate 50Mbit burst 1537b lat 50ms Sent 37766372 bytes 24974 pkt (dropped 327, overlimits 96017 requeues 0) backlog 0b 0p requeues 0tbf segments the GSO SKBs (tbf_segment) and updates the netem s  qlen .The interface fully stops transferring packets and  locks . In this case,the child qdisc and tfifo are empty, but  qlen  indicates the tfifo is atits limit and no more packets are accepted.This patch adds a counter for the entries in the tfifo. Netem s  qlen  isonly decreased when a packet is returned by its dequeue function, and notduring enqueuing into the child qdisc. External updates to  qlen  are thusaccounted for and only the behavior of the backlog statistics changes. Asin other qdiscs,  qlen  then keeps track of  how many packets are held innetem and all of its children. As before, sch->limit remains as themaximum number of packets in the tfifo. The same applies to netem sbacklog statistics.
 漏洞公开时间：2025-01-09 01:15:15
 漏洞创建时间：2025-01-22 17:35:56
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2024-56770
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/10df49cfca73dfbbdb6c4150d859f7e8926ae427 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/216509dda290f6db92c816dd54b83c1df9da9e76 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/356078a5c55ec8d2061fcc009fb8599f5b0527f9 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/3824c5fad18eeb7abe0c4fc966f29959552dca3e |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/83c6ab12f08dcc09d4c5ac86fdb89736b28f1d31 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/c2047b0e216c8edce227d7c42f99ac2877dad0e4 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/f8d4bc455047cf3903cd6f85f49978987dbb3027 |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-56770 | https://bugzilla.suse.com/show_bug.cgi?id=1235637 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2024/CVE-2024-56770.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1235637 |
| suse_bugzilla | https://git.kernel.org/stable/c/83c6ab12f08dcc09d4c5ac86fdb89736b28f1d31 | https://bugzilla.suse.com/show_bug.cgi?id=1235637 |
| suse_bugzilla | https://git.kernel.org/stable/c/216509dda290f6db92c816dd54b83c1df9da9e76 | https://bugzilla.suse.com/show_bug.cgi?id=1235637 |
| suse_bugzilla | https://git.kernel.org/stable/c/c2047b0e216c8edce227d7c42f99ac2877dad0e4 | https://bugzilla.suse.com/show_bug.cgi?id=1235637 |
| suse_bugzilla | https://git.kernel.org/stable/c/10df49cfca73dfbbdb6c4150d859f7e8926ae427 | https://bugzilla.suse.com/show_bug.cgi?id=1235637 |
| suse_bugzilla | https://git.kernel.org/stable/c/3824c5fad18eeb7abe0c4fc966f29959552dca3e | https://bugzilla.suse.com/show_bug.cgi?id=1235637 |
| suse_bugzilla | https://git.kernel.org/stable/c/356078a5c55ec8d2061fcc009fb8599f5b0527f9 | https://bugzilla.suse.com/show_bug.cgi?id=1235637 |
| suse_bugzilla | https://git.kernel.org/stable/c/f8d4bc455047cf3903cd6f85f49978987dbb3027 | https://bugzilla.suse.com/show_bug.cgi?id=1235637 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2024-56770 | https://bugzilla.suse.com/show_bug.cgi?id=1235637 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2336429 | https://bugzilla.suse.com/show_bug.cgi?id=1235637 |
| redhat_bugzilla | https://lore.kernel.org/linux-cve-announce/2025010803-CVE-2024-56770-62ce@gregkh/T | https://bugzilla.redhat.com/show_bug.cgi?id=2336429 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2024-56770 |
| mageia |  | http://advisories.mageia.org/MGASA-2025-0030.html |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://git.kernel.org/stable/c/10df49cfca73dfbbdb6c4150d859f7e8926ae427 |  | nvd |
|  |  | https://git.kernel.org/stable/c/216509dda290f6db92c816dd54b83c1df9da9e76 |  | nvd |
|  |  | https://git.kernel.org/stable/c/356078a5c55ec8d2061fcc009fb8599f5b0527f9 |  | nvd |
|  |  | https://git.kernel.org/stable/c/3824c5fad18eeb7abe0c4fc966f29959552dca3e |  | nvd |
|  |  | https://git.kernel.org/stable/c/83c6ab12f08dcc09d4c5ac86fdb89736b28f1d31 |  | nvd |
|  |  | https://git.kernel.org/stable/c/c2047b0e216c8edce227d7c42f99ac2877dad0e4 |  | nvd |
|  |  | https://git.kernel.org/stable/c/f8d4bc455047cf3903cd6f85f49978987dbb3027 |  | nvd |
| linux_kernel | 5.4.288 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=83c6ab12f08dcc09d4c5ac86fdb89736b28f1d31Issue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=50612537e9ab29693122fab20fc1eed235054ffe | linuxkernelcves |
| linux_kernel | 5.10.232 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=216509dda290f6db92c816dd54b83c1df9da9e76Issue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=50612537e9ab29693122fab20fc1eed235054ffe | linuxkernelcves |
| linux_kernel | 5.15.175 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=c2047b0e216c8edce227d7c42f99ac2877dad0e4Issue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=50612537e9ab29693122fab20fc1eed235054ffe | linuxkernelcves |
| linux_kernel | 6.1.121 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=10df49cfca73dfbbdb6c4150d859f7e8926ae427Issue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=50612537e9ab29693122fab20fc1eed235054ffe | linuxkernelcves |
| linux_kernel | 6.6.67 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=3824c5fad18eeb7abe0c4fc966f29959552dca3eIssue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=50612537e9ab29693122fab20fc1eed235054ffe | linuxkernelcves |
| linux_kernel | 6.12.6 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=356078a5c55ec8d2061fcc009fb8599f5b0527f9Issue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=50612537e9ab29693122fab20fc1eed235054ffe | linuxkernelcves |
| linux_kernel | 6.13-rc3 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=f8d4bc455047cf3903cd6f85f49978987dbb3027Please | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=50612537e9ab29693122fab20fc1eed235054ffe | linuxkernelcves |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:net/sched: netem: account for backlog updates from child qdiscIn general,  qlen  of any classful qdisc should keep track of thenumber of packets that the qdisc itself and all of its children holds.In case of netem,  qlen  only accounts for the packets in its internaltfifo. When netem is used with a child qdisc, the child qdisc can use qdisc_tree_reduce_backlog  to inform its parent, netem, about createdor dropped SKBs. This function updates  qlen  and the backlog statisticsof netem, but netem does not account for changes made by a child qdisc. qlen  then indicates the wrong number of packets in the tfifo.If a child qdisc creates new SKBs during enqueue and informs its parentabout this, netem s  qlen  value is increased. When netem dequeues thenewly created SKBs from the child, the  qlen  in netem is not updated.If  qlen  reaches the configured sch->limit, the enqueue function stopsworking, even though the tfifo is not full.Reproduce the bug:Ensure that the sender machine has GSO enabled. Configure netem as rootqdisc and tbf as its child on the outgoing interface of the machineas follows:$ tc qdisc add dev <oif> root handle 1: netem delay 100ms limit 100$ tc qdisc add dev <oif> parent 1:0 tbf rate 50Mbit burst 1542 latency 50msSend bulk TCP traffic out via this interface, e.g., by running an iPerf3client on the machine. Check the qdisc statistics:$ tc -s qdisc show dev <oif>Statistics after 10s of iPerf3 TCP test before the fix (note thatnetem s backlog > limit, netem stopped accepting packets):qdisc netem 1: root refcnt 2 limit 1000 delay 100ms Sent 2767766 bytes 1848 pkt (dropped 652, overlimits 0 requeues 0) backlog 4294528236b 1155p requeues 0qdisc tbf 10: parent 1:1 rate 50Mbit burst 1537b lat 50ms Sent 2767766 bytes 1848 pkt (dropped 327, overlimits 7601 requeues 0) backlog 0b 0p requeues 0Statistics after the fix:qdisc netem 1: root refcnt 2 limit 1000 delay 100ms Sent 37766372 bytes 24974 pkt (dropped 9, overlimits 0 requeues 0) backlog 0b 0p requeues 0qdisc tbf 10: parent 1:1 rate 50Mbit burst 1537b lat 50ms Sent 37766372 bytes 24974 pkt (dropped 327, overlimits 96017 requeues 0) backlog 0b 0p requeues 0tbf segments the GSO SKBs (tbf_segment) and updates the netem s  qlen .The interface fully stops transferring packets and  locks . In this case,the child qdisc and tfifo are empty, but  qlen  indicates the tfifo is atits limit and no more packets are accepted.This patch adds a counter for the entries in the tfifo. Netem s  qlen  isonly decreased when a packet is returned by its dequeue function, and notduring enqueuing into the child qdisc. External updates to  qlen  are thusaccounted for and only the behavior of the backlog statistics changes. Asin other qdiscs,  qlen  then keeps track of  how many packets are held innetem and all of its children. As before, sch->limit remains as themaximum number of packets in the tfifo. The same applies to netem sbacklog statistics.
 openEuler评分：
  5.5
 Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP4(4.19.90):受影响
2.openEuler-22.03-LTS-SP3(5.10.0):受影响
3.openEuler-22.03-LTS-SP4(5.10.0):受影响
4.openEuler-24.03-LTS(6.6.0):受影响
5.openEuler-24.03-LTS-SP1(6.6.0):受影响
6.master(6.6.0):不受影响
7.openEuler-24.03-LTS-Next(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP4(4.19.90):否
2.openEuler-22.03-LTS-SP3(5.10.0):否
3.master(6.6.0):否
4.openEuler-24.03-LTS(6.6.0):否
5.openEuler-24.03-LTS-Next(6.6.0):否
6.openEuler-22.03-LTS-SP4(5.10.0):否
7.openEuler-24.03-LTS-SP1(6.6.0):否

原因说明：
  1.openEuler-24.03-LTS(6.6.0):正常修复
2.openEuler-24.03-LTS-SP1(6.6.0):正常修复
3.openEuler-20.03-LTS-SP4(4.19.90):不修复-超出修复范围
4.openEuler-22.03-LTS-SP3(5.10.0):不修复-超出修复范围
5.openEuler-22.03-LTS-SP4(5.10.0):不修复-超出修复范围
6.master(6.6.0):不受影响-漏洞代码不能被攻击者触发
7.openEuler-24.03-LTS-Next(6.6.0):不受影响-漏洞代码不能被攻击者触发

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2025-1249

src-openEuler/kernel

内容风险标识

评论 (14)

src-openEuler/kernel .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2024-56770

评论 (14)

搜索帮助

src-openEuler/kernel