CVE-2024-57994

一、漏洞信息
 漏洞编号：[CVE-2024-57994](https://nvd.nist.gov/vuln/detail/CVE-2024-57994)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.19,6.1.8,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：5.5 Medium
  Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:ptr_ring: do not block hard interrupts in ptr_ring_resize_multiple()Jakub added a lockdep_assert_no_hardirq() check in __page_pool_put_page()to increase test coverage.syzbot found a splat caused by hard irq blocking inptr_ring_resize_multiple() [1]As current users of ptr_ring_resize_multiple() do not requirehard irqs being masked, replace it to only block BH.Rename helpers to better reflect they are safe against BH only.- ptr_ring_resize_multiple() to ptr_ring_resize_multiple_bh()- skb_array_resize_multiple() to skb_array_resize_multiple_bh()[1]WARNING: CPU: 1 PID: 9150 at net/core/page_pool.c:709 __page_pool_put_page net/core/page_pool.c:709 [inline]WARNING: CPU: 1 PID: 9150 at net/core/page_pool.c:709 page_pool_put_unrefed_netmem+0x157/0xa40 net/core/page_pool.c:780Modules linked in:CPU: 1 UID: 0 PID: 9150 Comm: syz.1.1052 Not tainted 6.11.0-rc3-syzkaller-00202-gf8669d7b5f5d #0Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024RIP: 0010:__page_pool_put_page net/core/page_pool.c:709 [inline]RIP: 0010:page_pool_put_unrefed_netmem+0x157/0xa40 net/core/page_pool.c:780Code: 74 0e e8 7c aa fb f7 eb 43 e8 75 aa fb f7 eb 3c 65 8b 1d 38 a8 6a 76 31 ff 89 de e8 a3 ae fb f7 85 db 74 0b e8 5a aa fb f7 90 <0f> 0b 90 eb 1d 65 8b 1d 15 a8 6a 76 31 ff 89 de e8 84 ae fb f7 85RSP: 0018:ffffc9000bda6b58 EFLAGS: 00010083RAX: ffffffff8997e523 RBX: 0000000000000000 RCX: 0000000000040000RDX: ffffc9000fbd0000 RSI: 0000000000001842 RDI: 0000000000001843RBP: 0000000000000000 R08: ffffffff8997df2c R09: 1ffffd40003a000dR10: dffffc0000000000 R11: fffff940003a000e R12: ffffea0001d00040R13: ffff88802e8a4000 R14: dffffc0000000000 R15: 00000000ffffffffFS:  00007fb7aaf716c0(0000) GS:ffff8880b9300000(0000) knlGS:0000000000000000CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033CR2: 00007fa15a0d4b72 CR3: 00000000561b0000 CR4: 00000000003506f0DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400Call Trace: <TASK> tun_ptr_free drivers/net/tun.c:617 [inline] __ptr_ring_swap_queue include/linux/ptr_ring.h:571 [inline] ptr_ring_resize_multiple_noprof include/linux/ptr_ring.h:643 [inline] tun_queue_resize drivers/net/tun.c:3694 [inline] tun_device_event+0xaaf/0x1080 drivers/net/tun.c:3714 notifier_call_chain+0x19f/0x3e0 kernel/notifier.c:93 call_netdevice_notifiers_extack net/core/dev.c:2032 [inline] call_netdevice_notifiers net/core/dev.c:2046 [inline] dev_change_tx_queue_len+0x158/0x2a0 net/core/dev.c:9024 do_setlink+0xff6/0x41f0 net/core/rtnetlink.c:2923 rtnl_setlink+0x40d/0x5a0 net/core/rtnetlink.c:3201 rtnetlink_rcv_msg+0x73f/0xcf0 net/core/rtnetlink.c:6647 netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2550
 漏洞公开时间：2025-02-27 10:15:13
 漏洞创建时间：2025-02-27 11:28:21
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2024-57994
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/3257dac521d0ac6653108c755141dce634bb8ff2 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/a126061c80d5efb4baef4bcf346094139cd81df6 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/e74801b7628dc52b17471aec729bc675479ddc73 |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-57994 | https://bugzilla.suse.com/show_bug.cgi?id=1237901 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2024-57994 | https://bugzilla.suse.com/show_bug.cgi?id=1237901 |
| suse_bugzilla | https://git.kernel.org/stable/c/3257dac521d0ac6653108c755141dce634bb8ff2 | https://bugzilla.suse.com/show_bug.cgi?id=1237901 |
| suse_bugzilla | https://git.kernel.org/stable/c/a126061c80d5efb4baef4bcf346094139cd81df6 | https://bugzilla.suse.com/show_bug.cgi?id=1237901 |
| suse_bugzilla | https://git.kernel.org/stable/c/e74801b7628dc52b17471aec729bc675479ddc73 | https://bugzilla.suse.com/show_bug.cgi?id=1237901 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2024/CVE-2024-57994.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1237901 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2024-57994 |
| osv | https://git.kernel.org/stable/c/3257dac521d0ac6653108c755141dce634bb8ff2 | https://osv.dev/vulnerability/CVE-2024-57994 |
| osv | https://git.kernel.org/stable/c/a126061c80d5efb4baef4bcf346094139cd81df6 | https://osv.dev/vulnerability/CVE-2024-57994 |
| osv | https://git.kernel.org/stable/c/e74801b7628dc52b17471aec729bc675479ddc73 | https://osv.dev/vulnerability/CVE-2024-57994 |
| osv | https://security-tracker.debian.org/tracker/CVE-2024-57994 | https://osv.dev/vulnerability/CVE-2024-57994 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
| linux_kernel | 6.12.13 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=3257dac521d0ac6653108c755141dce634bb8ff2Issue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=ff4e538c8c3e675a15e1e49509c55951832e0451 | linuxkernelcves |
| linux_kernel | 6.13.2 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=e74801b7628dc52b17471aec729bc675479ddc73Issue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=ff4e538c8c3e675a15e1e49509c55951832e0451 | linuxkernelcves |
| linux_kernel | 6.14-rc1 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=a126061c80d5efb4baef4bcf346094139cd81df6Please | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=ff4e538c8c3e675a15e1e49509c55951832e0451 | linuxkernelcves |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
                            In the Linux kernel, the following vulnerability has been resolved:ptr_ring: do not block hard interrupts in ptr_ring_resize_multiple()Jakub added a lockdep_assert_no_hardirq() check in __page_pool_put_page()to increase test coverage.syzbot found a splat caused by hard irq blocking inptr_ring_resize_multiple() [1]As current users of ptr_ring_resize_multiple() do not requirehard irqs being masked, replace it to only block BH.Rename helpers to better reflect they are safe against BH only.- ptr_ring_resize_multiple() to ptr_ring_resize_multiple_bh()- skb_array_resize_multiple() to skb_array_resize_multiple_bh()[1]WARNING: CPU: 1 PID: 9150 at net/core/page_pool.c:709 __page_pool_put_page net/core/page_pool.c:709 [inline]WARNING: CPU: 1 PID: 9150 at net/core/page_pool.c:709 page_pool_put_unrefed_netmem+0x157/0xa40 net/core/page_pool.c:780Modules linked in:CPU: 1 UID: 0 PID: 9150 Comm: syz.1.1052 Not tainted 6.11.0-rc3-syzkaller-00202-gf8669d7b5f5d #0Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024RIP: 0010:__page_pool_put_page net/core/page_pool.c:709 [inline]RIP: 0010:page_pool_put_unrefed_netmem+0x157/0xa40 net/core/page_pool.c:780Code: 74 0e e8 7c aa fb f7 eb 43 e8 75 aa fb f7 eb 3c 65 8b 1d 38 a8 6a 76 31 ff 89 de e8 a3 ae fb f7 85 db 74 0b e8 5a aa fb f7 90 <0f> 0b 90 eb 1d 65 8b 1d 15 a8 6a 76 31 ff 89 de e8 84 ae fb f7 85RSP: 0018:ffffc9000bda6b58 EFLAGS: 00010083RAX: ffffffff8997e523 RBX: 0000000000000000 RCX: 0000000000040000RDX: ffffc9000fbd0000 RSI: 0000000000001842 RDI: 0000000000001843RBP: 0000000000000000 R08: ffffffff8997df2c R09: 1ffffd40003a000dR10: dffffc0000000000 R11: fffff940003a000e R12: ffffea0001d00040R13: ffff88802e8a4000 R14: dffffc0000000000 R15: 00000000ffffffffFS:  00007fb7aaf716c0(0000) GS:ffff8880b9300000(0000) knlGS:0000000000000000CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033CR2: 00007fa15a0d4b72 CR3: 00000000561b0000 CR4: 00000000003506f0DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400Call Trace: <TASK> tun_ptr_free drivers/net/tun.c:617 [inline] __ptr_ring_swap_queue include/linux/ptr_ring.h:571 [inline] ptr_ring_resize_multiple_noprof include/linux/ptr_ring.h:643 [inline] tun_queue_resize drivers/net/tun.c:3694 [inline] tun_device_event+0xaaf/0x1080 drivers/net/tun.c:3714 notifier_call_chain+0x19f/0x3e0 kernel/notifier.c:93 call_netdevice_notifiers_extack net/core/dev.c:2032 [inline] call_netdevice_notifiers net/core/dev.c:2046 [inline] dev_change_tx_queue_len+0x158/0x2a0 net/core/dev.c:9024 do_setlink+0xff6/0x41f0 net/core/rtnetlink.c:2923 rtnl_setlink+0x40d/0x5a0 net/core/rtnetlink.c:3201 rtnetlink_rcv_msg+0x73f/0xcf0 net/core/rtnetlink.c:6647 netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2550             
 openEuler评分：
  5.5
 Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-24.03-LTS:受影响
2.openEuler-24.03-LTS-SP1:受影响
3.openEuler-24.03-LTS-SP2:受影响
4.openEuler-20.03-LTS-SP4(4.19.90):不受影响
5.openEuler-22.03-LTS-SP3(5.10.0):不受影响
6.openEuler-22.03-LTS-SP4(5.10.0):不受影响
7.master(6.12.33):不受影响
8.openEuler-24.03-LTS-Next:不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP4(4.19.90):否
2.openEuler-22.03-LTS-SP3(5.10.0):否
3.master(6.12.33):否
4.openEuler-24.03-LTS:否
5.openEuler-24.03-LTS-Next:否
6.openEuler-22.03-LTS-SP4(5.10.0):否
7.openEuler-24.03-LTS-SP1:否
8.openEuler-24.03-LTS-SP2:否

原因说明：
  1.openEuler-24.03-LTS:正常修复
2.openEuler-24.03-LTS-SP1:正常修复
3.openEuler-24.03-LTS-SP2:正常修复
4.master(6.12.33):不受影响-漏洞代码不能被攻击者触发
5.openEuler-24.03-LTS-Next:不受影响-漏洞代码不能被攻击者触发
6.openEuler-20.03-LTS-SP4(4.19.90):不受影响-漏洞代码不存在
7.openEuler-22.03-LTS-SP3(5.10.0):不受影响-漏洞代码不存在
8.openEuler-22.03-LTS-SP4(5.10.0):不受影响-漏洞代码不存在

src-openEuler/kernel
Closed

Content Risk Flag

Comments (9)

src-openEuler/kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2024-57994

Comments (9)

Search

src-openEuler/kernel
Closed