CVE-2024-57996

一、漏洞信息
 漏洞编号：[CVE-2024-57996](https://nvd.nist.gov/vuln/detail/CVE-2024-57996)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.19,6.1.8,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：5.5 Medium
  Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:net_sched: sch_sfq: don t allow 1 packet limitThe current implementation does not work correctly with a limit of1. iproute2 actually checks for this and this patch adds the check inkernel as well.This fixes the following syzkaller reported crash:UBSAN: array-index-out-of-bounds in net/sched/sch_sfq.c:210:6index 65535 is out of range for type  struct sfq_head[128] CPU: 0 PID: 2569 Comm: syz-executor101 Not tainted 5.10.0-smp-DEV #1Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024Call Trace:  __dump_stack lib/dump_stack.c:79 [inline]  dump_stack+0x125/0x19f lib/dump_stack.c:120  ubsan_epilogue lib/ubsan.c:148 [inline]  __ubsan_handle_out_of_bounds+0xed/0x120 lib/ubsan.c:347  sfq_link net/sched/sch_sfq.c:210 [inline]  sfq_dec+0x528/0x600 net/sched/sch_sfq.c:238  sfq_dequeue+0x39b/0x9d0 net/sched/sch_sfq.c:500  sfq_reset+0x13/0x50 net/sched/sch_sfq.c:525  qdisc_reset+0xfe/0x510 net/sched/sch_generic.c:1026  tbf_reset+0x3d/0x100 net/sched/sch_tbf.c:319  qdisc_reset+0xfe/0x510 net/sched/sch_generic.c:1026  dev_reset_queue+0x8c/0x140 net/sched/sch_generic.c:1296  netdev_for_each_tx_queue include/linux/netdevice.h:2350 [inline]  dev_deactivate_many+0x6dc/0xc20 net/sched/sch_generic.c:1362  __dev_close_many+0x214/0x350 net/core/dev.c:1468  dev_close_many+0x207/0x510 net/core/dev.c:1506  unregister_netdevice_many+0x40f/0x16b0 net/core/dev.c:10738  unregister_netdevice_queue+0x2be/0x310 net/core/dev.c:10695  unregister_netdevice include/linux/netdevice.h:2893 [inline]  __tun_detach+0x6b6/0x1600 drivers/net/tun.c:689  tun_detach drivers/net/tun.c:705 [inline]  tun_chr_close+0x104/0x1b0 drivers/net/tun.c:3640  __fput+0x203/0x840 fs/file_table.c:280  task_work_run+0x129/0x1b0 kernel/task_work.c:185  exit_task_work include/linux/task_work.h:33 [inline]  do_exit+0x5ce/0x2200 kernel/exit.c:931  do_group_exit+0x144/0x310 kernel/exit.c:1046  __do_sys_exit_group kernel/exit.c:1057 [inline]  __se_sys_exit_group kernel/exit.c:1055 [inline]  __x64_sys_exit_group+0x3b/0x40 kernel/exit.c:1055 do_syscall_64+0x6c/0xd0 entry_SYSCALL_64_after_hwframe+0x61/0xcbRIP: 0033:0x7fe5e7b52479Code: Unable to access opcode bytes at RIP 0x7fe5e7b5244f.RSP: 002b:00007ffd3c800398 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fe5e7b52479RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000RBP: 00007fe5e7bcd2d0 R08: ffffffffffffffb8 R09: 0000000000000014R10: 0000000000000000 R11: 0000000000000246 R12: 00007fe5e7bcd2d0R13: 0000000000000000 R14: 00007fe5e7bcdd20 R15: 00007fe5e7b24270The crash can be also be reproduced with the following (with a tcrecompiled to allow for sfq limits of 1):tc qdisc add dev dummy0 handle 1: root tbf rate 1Kbit burst 100b lat 1s../iproute2-6.9.0/tc/tc qdisc add dev dummy0 handle 2: parent 1:10 sfq limit 1ifconfig dummy0 upping -I dummy0 -f -c2 -W0.1 8.8.8.8sleep 1Scenario that triggers the crash:* the first packet is sent and queued in TBF and SFQ; qdisc qlen is 1* TBF dequeues: it peeks from SFQ which moves the packet to the  gso_skb list and keeps qdisc qlen set to 1. TBF is out of tokens so  it schedules itself for later.* the second packet is sent and TBF tries to queues it to SFQ. qdisc  qlen is now 2 and because the SFQ limit is 1 the packet is dropped  by SFQ. At this point qlen is 1, and all of the SFQ slots are empty,  however q->tail is not NULL.At this point, assuming no more packets are queued, when sch_dequeueruns again it will decrement the qlen for the current empty slotcausing an underflow and the subsequent out of bounds access.
 漏洞公开时间：2025-02-27 10:15:13
 漏洞创建时间：2025-03-22 16:39:08
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2024-57996
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/10685681bafce6febb39770f3387621bf5d67d0b |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/35d0137305ae2f97260a9047f445bd4434bd6cc7 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/7d8947f2153ee9c5ab4cb17861a11cc45f30e8c4 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/7fefc294204f10a3405f175f4ac2be16d63f135e |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/833e9a1c27b82024db7ff5038a51651f48f05e5e |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-57996 | https://bugzilla.suse.com/show_bug.cgi?id=1239076 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2024-57996 | https://bugzilla.suse.com/show_bug.cgi?id=1239076 |
| suse_bugzilla | https://git.kernel.org/stable/c/10685681bafce6febb39770f3387621bf5d67d0b | https://bugzilla.suse.com/show_bug.cgi?id=1239076 |
| suse_bugzilla | https://git.kernel.org/stable/c/35d0137305ae2f97260a9047f445bd4434bd6cc7 | https://bugzilla.suse.com/show_bug.cgi?id=1239076 |
| suse_bugzilla | https://git.kernel.org/stable/c/7d8947f2153ee9c5ab4cb17861a11cc45f30e8c4 | https://bugzilla.suse.com/show_bug.cgi?id=1239076 |
| suse_bugzilla | https://git.kernel.org/stable/c/7fefc294204f10a3405f175f4ac2be16d63f135e | https://bugzilla.suse.com/show_bug.cgi?id=1239076 |
| suse_bugzilla | https://git.kernel.org/stable/c/833e9a1c27b82024db7ff5038a51651f48f05e5e | https://bugzilla.suse.com/show_bug.cgi?id=1239076 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2024/CVE-2024-57996.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1239076 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2348591 | https://bugzilla.suse.com/show_bug.cgi?id=1239076 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2024-57996 |
| osv | https://git.kernel.org/stable/c/10685681bafce6febb39770f3387621bf5d67d0b | https://osv.dev/vulnerability/CVE-2024-57996 |
| osv | https://git.kernel.org/stable/c/35d0137305ae2f97260a9047f445bd4434bd6cc7 | https://osv.dev/vulnerability/CVE-2024-57996 |
| osv | https://git.kernel.org/stable/c/7d8947f2153ee9c5ab4cb17861a11cc45f30e8c4 | https://osv.dev/vulnerability/CVE-2024-57996 |
| osv | https://git.kernel.org/stable/c/7fefc294204f10a3405f175f4ac2be16d63f135e | https://osv.dev/vulnerability/CVE-2024-57996 |
| osv | https://git.kernel.org/stable/c/833e9a1c27b82024db7ff5038a51651f48f05e5e | https://osv.dev/vulnerability/CVE-2024-57996 |
| osv | https://security-tracker.debian.org/tracker/CVE-2024-57996 | https://osv.dev/vulnerability/CVE-2024-57996 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  其它
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://git.kernel.org/stable/c/10685681bafce6febb39770f3387621bf5d67d0b |  | nvd |
|  |  | https://git.kernel.org/stable/c/35d0137305ae2f97260a9047f445bd4434bd6cc7 |  | nvd |
|  |  | https://git.kernel.org/stable/c/7d8947f2153ee9c5ab4cb17861a11cc45f30e8c4 |  | nvd |
|  |  | https://git.kernel.org/stable/c/7fefc294204f10a3405f175f4ac2be16d63f135e |  | nvd |
|  |  | https://git.kernel.org/stable/c/833e9a1c27b82024db7ff5038a51651f48f05e5e |  | nvd |
| linux_kernel | 6.1.129 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=35d0137305ae2f97260a9047f445bd4434bd6cc7Issue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 | linuxkernelcves |
| linux_kernel | 6.6.76 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=833e9a1c27b82024db7ff5038a51651f48f05e5eIssue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 | linuxkernelcves |
| linux_kernel | 6.12.13 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=7d8947f2153ee9c5ab4cb17861a11cc45f30e8c4Issue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 | linuxkernelcves |
| linux_kernel | 6.13.2 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=7fefc294204f10a3405f175f4ac2be16d63f135eIssue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 | linuxkernelcves |
| linux_kernel | 6.14-rc1 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=10685681bafce6febb39770f3387621bf5d67d0bPlease | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 | linuxkernelcves |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:net_sched: sch_sfq: don t allow 1 packet limitThe current implementation does not work correctly with a limit of1. iproute2 actually checks for this and this patch adds the check inkernel as well.This fixes the following syzkaller reported crash:UBSAN: array-index-out-of-bounds in net/sched/sch_sfq.c:210:6index 65535 is out of range for type  struct sfq_head[128] CPU: 0 PID: 2569 Comm: syz-executor101 Not tainted 5.10.0-smp-DEV #1Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024Call Trace:  __dump_stack lib/dump_stack.c:79 [inline]  dump_stack+0x125/0x19f lib/dump_stack.c:120  ubsan_epilogue lib/ubsan.c:148 [inline]  __ubsan_handle_out_of_bounds+0xed/0x120 lib/ubsan.c:347  sfq_link net/sched/sch_sfq.c:210 [inline]  sfq_dec+0x528/0x600 net/sched/sch_sfq.c:238  sfq_dequeue+0x39b/0x9d0 net/sched/sch_sfq.c:500  sfq_reset+0x13/0x50 net/sched/sch_sfq.c:525  qdisc_reset+0xfe/0x510 net/sched/sch_generic.c:1026  tbf_reset+0x3d/0x100 net/sched/sch_tbf.c:319  qdisc_reset+0xfe/0x510 net/sched/sch_generic.c:1026  dev_reset_queue+0x8c/0x140 net/sched/sch_generic.c:1296  netdev_for_each_tx_queue include/linux/netdevice.h:2350 [inline]  dev_deactivate_many+0x6dc/0xc20 net/sched/sch_generic.c:1362  __dev_close_many+0x214/0x350 net/core/dev.c:1468  dev_close_many+0x207/0x510 net/core/dev.c:1506  unregister_netdevice_many+0x40f/0x16b0 net/core/dev.c:10738  unregister_netdevice_queue+0x2be/0x310 net/core/dev.c:10695  unregister_netdevice include/linux/netdevice.h:2893 [inline]  __tun_detach+0x6b6/0x1600 drivers/net/tun.c:689  tun_detach drivers/net/tun.c:705 [inline]  tun_chr_close+0x104/0x1b0 drivers/net/tun.c:3640  __fput+0x203/0x840 fs/file_table.c:280  task_work_run+0x129/0x1b0 kernel/task_work.c:185  exit_task_work include/linux/task_work.h:33 [inline]  do_exit+0x5ce/0x2200 kernel/exit.c:931  do_group_exit+0x144/0x310 kernel/exit.c:1046  __do_sys_exit_group kernel/exit.c:1057 [inline]  __se_sys_exit_group kernel/exit.c:1055 [inline]  __x64_sys_exit_group+0x3b/0x40 kernel/exit.c:1055 do_syscall_64+0x6c/0xd0 entry_SYSCALL_64_after_hwframe+0x61/0xcbRIP: 0033:0x7fe5e7b52479Code: Unable to access opcode bytes at RIP 0x7fe5e7b5244f.RSP: 002b:00007ffd3c800398 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fe5e7b52479RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000RBP: 00007fe5e7bcd2d0 R08: ffffffffffffffb8 R09: 0000000000000014R10: 0000000000000000 R11: 0000000000000246 R12: 00007fe5e7bcd2d0R13: 0000000000000000 R14: 00007fe5e7bcdd20 R15: 00007fe5e7b24270The crash can be also be reproduced with the following (with a tcrecompiled to allow for sfq limits of 1):tc qdisc add dev dummy0 handle 1: root tbf rate 1Kbit burst 100b lat 1s../iproute2-6.9.0/tc/tc qdisc add dev dummy0 handle 2: parent 1:10 sfq limit 1ifconfig dummy0 upping -I dummy0 -f -c2 -W0.1 8.8.8.8sleep 1Scenario that triggers the crash:* the first packet is sent and queued in TBF and SFQ; qdisc qlen is 1* TBF dequeues: it peeks from SFQ which moves the packet to the  gso_skb list and keeps qdisc qlen set to 1. TBF is out of tokens so  it schedules itself for later.* the second packet is sent and TBF tries to queues it to SFQ. qdisc  qlen is now 2 and because the SFQ limit is 1 the packet is dropped  by SFQ. At this point qlen is 1, and all of the SFQ slots are empty,  however q->tail is not NULL.At this point, assuming no more packets are queued, when sch_dequeueruns again it will decrement the qlen for the current empty slotcausing an underflow and the subsequent out of bounds access.
 openEuler评分：
  5.5
 Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP4(4.19.90):受影响
2.openEuler-22.03-LTS-SP3(5.10.0):受影响
3.openEuler-22.03-LTS-SP4(5.10.0):受影响
4.openEuler-24.03-LTS(6.6.0):受影响
5.openEuler-24.03-LTS-SP1(6.6.0):受影响
6.master(6.6.0):不受影响
7.openEuler-24.03-LTS-Next(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP4(4.19.90):否
2.openEuler-22.03-LTS-SP3(5.10.0):否
3.master(6.6.0):否
4.openEuler-24.03-LTS(6.6.0):否
5.openEuler-24.03-LTS-Next(6.6.0):否
6.openEuler-22.03-LTS-SP4(5.10.0):否
7.openEuler-24.03-LTS-SP1(6.6.0):否

原因说明：
  1.openEuler-20.03-LTS-SP4(4.19.90):正常修复
2.openEuler-24.03-LTS(6.6.0):正常修复
3.openEuler-24.03-LTS-SP1(6.6.0):正常修复
4.openEuler-22.03-LTS-SP3(5.10.0):不修复-超出修复范围
5.openEuler-22.03-LTS-SP4(5.10.0):不修复-超出修复范围
6.master(6.6.0):不受影响-漏洞代码不能被攻击者触发
7.openEuler-24.03-LTS-Next(6.6.0):不受影响-漏洞代码不能被攻击者触发

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2025-1450

src-openEuler/kernel

内容风险标识

评论 (11)

src-openEuler/kernel .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2024-57996

评论 (11)

搜索帮助

src-openEuler/kernel