CVE-2024-57999

一、漏洞信息
 漏洞编号：[CVE-2024-57999](https://nvd.nist.gov/vuln/detail/CVE-2024-57999)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.19,6.1.8,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：N/A None
  Vector：CVSS：3.0/
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:powerpc/pseries/iommu: IOMMU incorrectly marks MMIO range in DDWPower Hypervisor can possibily allocate MMIO window intersecting withDynamic DMA Window (DDW) range, which is over 32-bit addressing.These MMIO pages needs to be marked as reserved so that IOMMU doesn t mapDMA buffers in this range.The current code is not marking these pages correctly which is resultingin LPAR to OOPS while booting. The stack is at belowBUG: Unable to handle kernel data access on read at 0xc00800005cd40000Faulting instruction address: 0xc00000000005cdacOops: Kernel access of bad area, sig: 11 [#1]LE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=2048 NUMA pSeriesModules linked in: af_packet rfkill ibmveth(X) lpfc(+) nvmet_fc nvmet nvme_keyring crct10dif_vpmsum nvme_fc nvme_fabrics nvme_core be2net(+) nvme_auth rtc_generic nfsd auth_rpcgss nfs_acl lockd grace sunrpc fuse configfs ip_tables x_tables xfs libcrc32c dm_service_time ibmvfc(X) scsi_transport_fc vmx_crypto gf128mul crc32c_vpmsum dm_mirror dm_region_hash dm_log dm_multipath dm_mod sd_mod scsi_dh_emc scsi_dh_rdac scsi_dh_alua t10_pi crc64_rocksoft_generic crc64_rocksoft sg crc64 scsi_modSupported: Yes, ExternalCPU: 8 PID: 241 Comm: kworker/8:1 Kdump: loaded Not tainted 6.4.0-150600.23.14-default #1 SLE15-SP6 b44ee71c81261b9e4bab5e0cde1f2ed891d5359bHardware name: IBM,9080-M9S POWER9 (raw) 0x4e2103 0xf000005 of:IBM,FW950.B0 (VH950_149) hv:phyp pSeriesWorkqueue: events work_for_cpu_fnNIP:  c00000000005cdac LR: c00000000005e830 CTR: 0000000000000000REGS: c00001400c9ff770 TRAP: 0300   Not tainted  (6.4.0-150600.23.14-default)MSR:  800000000280b033 <SF,VEC,VSX,EE,FP,ME,IR,DR,RI,LE>  CR: 24228448  XER: 00000001CFAR: c00000000005cdd4 DAR: c00800005cd40000 DSISR: 40000000 IRQMASK: 0GPR00: c00000000005e830 c00001400c9ffa10 c000000001987d00 c00001400c4fe800GPR04: 0000080000000000 0000000000000001 0000000004000000 0000000000800000GPR08: 0000000004000000 0000000000000001 c00800005cd40000 ffffffffffffffffGPR12: 0000000084228882 c00000000a4c4f00 0000000000000010 0000080000000000GPR16: c00001400c4fe800 0000000004000000 0800000000000000 c00000006088b800GPR20: c00001401a7be980 c00001400eff3800 c000000002a2da68 000000000000002bGPR24: c0000000026793a8 c000000002679368 000000000000002a c0000000026793c8GPR28: 000008007effffff 0000080000000000 0000000000800000 c00001400c4fe800NIP [c00000000005cdac] iommu_table_reserve_pages+0xac/0x100LR [c00000000005e830] iommu_init_table+0x80/0x1e0Call Trace:[c00001400c9ffa10] [c00000000005e810] iommu_init_table+0x60/0x1e0 (unreliable)[c00001400c9ffa90] [c00000000010356c] iommu_bypass_supported_pSeriesLP+0x9cc/0xe40[c00001400c9ffc30] [c00000000005c300] dma_iommu_dma_supported+0xf0/0x230[c00001400c9ffcb0] [c00000000024b0c4] dma_supported+0x44/0x90[c00001400c9ffcd0] [c00000000024b14c] dma_set_mask+0x3c/0x80[c00001400c9ffd00] [c0080000555b715c] be_probe+0xc4/0xb90 [be2net][c00001400c9ffdc0] [c000000000986f3c] local_pci_probe+0x6c/0x110[c00001400c9ffe40] [c000000000188f28] work_for_cpu_fn+0x38/0x60[c00001400c9ffe70] [c00000000018e454] process_one_work+0x314/0x620[c00001400c9fff10] [c00000000018f280] worker_thread+0x2b0/0x620[c00001400c9fff90] [c00000000019bb18] kthread+0x148/0x150[c00001400c9fffe0] [c00000000000ded8] start_kernel_thread+0x14/0x18There are 2 issues in the code1. The index is  int  while the address is  unsigned long . This results in   negative value when setting the bitmap.2. The DMA offset is page shifted but the MMIO range is used as-is (64-bit   address). MMIO address needs to be page shifted as well.
 漏洞公开时间：2025-02-27 10:15:13
 漏洞创建时间：2025-02-27 11:40:31
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2024-57999
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/7043d58ecd1381674f5b2c894deb6986a1a4896b |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/8f70caad82e9c088ed93b4fea48d941ab6441886 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/d8cc20a8cceb3b5e8ad2e11365e3100ba36a27e9 |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-57999 | https://bugzilla.suse.com/show_bug.cgi?id=1238526 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2024-57999 | https://bugzilla.suse.com/show_bug.cgi?id=1238526 |
| suse_bugzilla | https://git.kernel.org/stable/c/7043d58ecd1381674f5b2c894deb6986a1a4896b | https://bugzilla.suse.com/show_bug.cgi?id=1238526 |
| suse_bugzilla | https://git.kernel.org/stable/c/8f70caad82e9c088ed93b4fea48d941ab6441886 | https://bugzilla.suse.com/show_bug.cgi?id=1238526 |
| suse_bugzilla | https://git.kernel.org/stable/c/d8cc20a8cceb3b5e8ad2e11365e3100ba36a27e9 | https://bugzilla.suse.com/show_bug.cgi?id=1238526 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2024/CVE-2024-57999.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1238526 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2348532 | https://bugzilla.suse.com/show_bug.cgi?id=1238526 |
| redhat_bugzilla | https://lore.kernel.org/linux-cve-announce/2025022641-CVE-2024-57999-1029@gregkh/T | https://bugzilla.redhat.com/show_bug.cgi?id=2348532 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2024-57999 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
| linux_kernel | 6.12.13 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=7043d58ecd1381674f5b2c894deb6986a1a4896bIssue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=3c33066a21903076722a2881556a92aa3cd7d359 | linuxkernelcves |
| linux_kernel | 6.13.2 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=d8cc20a8cceb3b5e8ad2e11365e3100ba36a27e9Issue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=3c33066a21903076722a2881556a92aa3cd7d359 | linuxkernelcves |
| linux_kernel | 6.14-rc1 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=8f70caad82e9c088ed93b4fea48d941ab6441886Please | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=3c33066a21903076722a2881556a92aa3cd7d359 | linuxkernelcves |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:powerpc/pseries/iommu: IOMMU incorrectly marks MMIO range in DDWPower Hypervisor can possibily allocate MMIO window intersecting withDynamic DMA Window (DDW) range, which is over 32-bit addressing.These MMIO pages needs to be marked as reserved so that IOMMU doesn&#39;t mapDMA buffers in this range.The current code is not marking these pages correctly which is resultingin LPAR to OOPS while booting. The stack is at belowBUG: Unable to handle kernel data access on read at 0xc00800005cd40000Faulting instruction address: 0xc00000000005cdacOops: Kernel access of bad area, sig: 11 [#1]LE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=2048 NUMA pSeriesModules linked in: af_packet rfkill ibmveth(X) lpfc(+) nvmet_fc nvmet nvme_keyring crct10dif_vpmsum nvme_fc nvme_fabrics nvme_core be2net(+) nvme_auth rtc_generic nfsd auth_rpcgss nfs_acl lockd grace sunrpc fuse configfs ip_tables x_tables xfs libcrc32c dm_service_time ibmvfc(X) scsi_transport_fc vmx_crypto gf128mul crc32c_vpmsum dm_mirror dm_region_hash dm_log dm_multipath dm_mod sd_mod scsi_dh_emc scsi_dh_rdac scsi_dh_alua t10_pi crc64_rocksoft_generic crc64_rocksoft sg crc64 scsi_modSupported: Yes, ExternalCPU: 8 PID: 241 Comm: kworker/8:1 Kdump: loaded Not tainted 6.4.0-150600.23.14-default #1 SLE15-SP6 b44ee71c81261b9e4bab5e0cde1f2ed891d5359bHardware name: IBM,9080-M9S POWER9 (raw) 0x4e2103 0xf000005 of:IBM,FW950.B0 (VH950_149) hv:phyp pSeriesWorkqueue: events work_for_cpu_fnNIP:  c00000000005cdac LR: c00000000005e830 CTR: 0000000000000000REGS: c00001400c9ff770 TRAP: 0300   Not tainted  (6.4.0-150600.23.14-default)MSR:  800000000280b033 &lt;SF,VEC,VSX,EE,FP,ME,IR,DR,RI,LE&gt;  CR: 24228448  XER: 00000001CFAR: c00000000005cdd4 DAR: c00800005cd40000 DSISR: 40000000 IRQMASK: 0GPR00: c00000000005e830 c00001400c9ffa10 c000000001987d00 c00001400c4fe800GPR04: 0000080000000000 0000000000000001 0000000004000000 0000000000800000GPR08: 0000000004000000 0000000000000001 c00800005cd40000 ffffffffffffffffGPR12: 0000000084228882 c00000000a4c4f00 0000000000000010 0000080000000000GPR16: c00001400c4fe800 0000000004000000 0800000000000000 c00000006088b800GPR20: c00001401a7be980 c00001400eff3800 c000000002a2da68 000000000000002bGPR24: c0000000026793a8 c000000002679368 000000000000002a c0000000026793c8GPR28: 000008007effffff 0000080000000000 0000000000800000 c00001400c4fe800NIP [c00000000005cdac] iommu_table_reserve_pages+0xac/0x100LR [c00000000005e830] iommu_init_table+0x80/0x1e0Call Trace:[c00001400c9ffa10] [c00000000005e810] iommu_init_table+0x60/0x1e0 (unreliable)[c00001400c9ffa90] [c00000000010356c] iommu_bypass_supported_pSeriesLP+0x9cc/0xe40[c00001400c9ffc30] [c00000000005c300] dma_iommu_dma_supported+0xf0/0x230[c00001400c9ffcb0] [c00000000024b0c4] dma_supported+0x44/0x90[c00001400c9ffcd0] [c00000000024b14c] dma_set_mask+0x3c/0x80[c00001400c9ffd00] [c0080000555b715c] be_probe+0xc4/0xb90 [be2net][c00001400c9ffdc0] [c000000000986f3c] local_pci_probe+0x6c/0x110[c00001400c9ffe40] [c000000000188f28] work_for_cpu_fn+0x38/0x60[c00001400c9ffe70] [c00000000018e454] process_one_work+0x314/0x620[c00001400c9fff10] [c00000000018f280] worker_thread+0x2b0/0x620[c00001400c9fff90] [c00000000019bb18] kthread+0x148/0x150[c00001400c9fffe0] [c00000000000ded8] start_kernel_thread+0x14/0x18There are 2 issues in the code1. The index is &#34;int&#34; while the address is &#34;unsigned long&#34;. This results in   negative value when setting the bitmap.2. The DMA offset is page shifted but the MMIO range is used as-is (64-bit   address). MMIO address needs to be page shifted as well.The Linux kernel CVE team has assigned CVE-2024-57999 to this issue.
 openEuler评分：
  5.5
 Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-24.03-LTS(6.6.0):受影响
2.openEuler-24.03-LTS-SP1(6.6.0):受影响
3.master(6.6.0):不受影响
4.openEuler-20.03-LTS-SP4(4.19.90):不受影响
5.openEuler-22.03-LTS-SP3(5.10.0):不受影响
6.openEuler-22.03-LTS-SP4(5.10.0):不受影响
7.openEuler-24.03-LTS-Next(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.master(6.6.0):否
2.openEuler-20.03-LTS-SP4(4.19.90):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.openEuler-22.03-LTS-SP4(5.10.0):否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-24.03-LTS-SP1(6.6.0):否

原因说明：
  1.openEuler-24.03-LTS(6.6.0):正常修复
2.openEuler-24.03-LTS-SP1(6.6.0):正常修复
3.master(6.6.0):不受影响-漏洞代码不能被攻击者触发
4.openEuler-24.03-LTS-Next(6.6.0):不受影响-漏洞代码不能被攻击者触发
5.openEuler-20.03-LTS-SP4(4.19.90):不受影响-漏洞代码不存在
6.openEuler-22.03-LTS-SP3(5.10.0):不受影响-漏洞代码不存在
7.openEuler-22.03-LTS-SP4(5.10.0):不受影响-漏洞代码不存在

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2025-1450

src-openEuler / kernel
Closed

Content Risk Flag

Comments (12)

src-openEuler / kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2024-57999

Comments (12)

Search

src-openEuler / kernel
Closed