CVE-2024-56664

一、漏洞信息
 漏洞编号：[CVE-2024-56664](https://nvd.nist.gov/vuln/detail/CVE-2024-56664)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.19,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：7.0 High
  Vector：CVSS：3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:bpf, sockmap: Fix race between element replace and close()Element replace (with a socket different from the one stored) may racewith socket s close() link popping & unlinking. __sock_map_delete()unconditionally unrefs the (wrong) element:// set map[0] = s0map_update_elem(map, 0, s0)// drop fd of s0close(s0)  sock_map_close()    lock_sock(sk)               (s0!)    sock_map_remove_links(sk)      link = sk_psock_link_pop()      sock_map_unlink(sk, link)        sock_map_delete_from_link                                        // replace map[0] with s1                                        map_update_elem(map, 0, s1)                                          sock_map_update_elem                                (s1!)       lock_sock(sk)                                            sock_map_update_common                                              psock = sk_psock(sk)                                              spin_lock(&stab->lock)                                              osk = stab->sks[idx]                                              sock_map_add_link(..., &stab->sks[idx])                                              sock_map_unref(osk, &stab->sks[idx])                                                psock = sk_psock(osk)                                                sk_psock_put(sk, psock)                                                  if (refcount_dec_and_test(&psock))                                                    sk_psock_drop(sk, psock)                                              spin_unlock(&stab->lock)                                            unlock_sock(sk)          __sock_map_delete            spin_lock(&stab->lock)            sk = *psk                        // s1 replaced s0; sk == s1            if (!sk_test || sk_test == sk)   // sk_test (s0) != sk (s1); no branch              sk = xchg(psk, NULL)            if (sk)              sock_map_unref(sk, psk)        // unref s1; sks[idx] will dangle                psock = sk_psock(sk)                sk_psock_put(sk, psock)                  if (refcount_dec_and_test())                    sk_psock_drop(sk, psock)            spin_unlock(&stab->lock)    release_sock(sk)Then close(map) enqueues bpf_map_free_deferred, which finally callssock_map_free(). This results in some refcount_t warnings along witha KASAN splat [1].Fix __sock_map_delete(), do not allow sock_map_unref() on elements thatmay have been replaced.[1]:BUG: KASAN: slab-use-after-free in sock_map_free+0x10e/0x330Write of size 4 at addr ffff88811f5b9100 by task kworker/u64:12/1063CPU: 14 UID: 0 PID: 1063 Comm: kworker/u64:12 Not tainted 6.12.0+ #125Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.16.3-1-1 04/01/2014Workqueue: events_unbound bpf_map_free_deferredCall Trace: <TASK> dump_stack_lvl+0x68/0x90 print_report+0x174/0x4f6 kasan_report+0xb9/0x190 kasan_check_range+0x10f/0x1e0 sock_map_free+0x10e/0x330 bpf_map_free_deferred+0x173/0x320 process_one_work+0x846/0x1420 worker_thread+0x5b3/0xf80 kthread+0x29e/0x360 ret_from_fork+0x2d/0x70 ret_from_fork_asm+0x1a/0x30 </TASK>Allocated by task 1202: kasan_save_stack+0x1e/0x40 kasan_save_track+0x10/0x30 __kasan_slab_alloc+0x85/0x90 kmem_cache_alloc_noprof+0x131/0x450 sk_prot_alloc+0x5b/0x220 sk_alloc+0x2c/0x870 unix_create1+0x88/0x8a0 unix_create+0xc5/0x180 __sock_create+0x241/0x650 __sys_socketpair+0x1ce/0x420 __x64_sys_socketpair+0x92/0x100 do_syscall_64+0x93/0x180 entry_SYSCALL_64_after_hwframe+0x76/0x7eFreed by task 46: kasan_save_stack+0x1e/0x40 kasan_save_track+0x10/0x30 kasan_save_free_info+0x37/0x60 __kasan_slab_free+0x4b/0x70 kmem_cache_free+0x1a1/0x590 __sk_destruct+0x388/0x5a0 sk_psock_destroy+0x73e/0xa50 process_one_work+0x846/0x1420 worker_thread+0x5b3/0xf80 kthread+0x29e/0x360 ret_from_fork+0x2d/0x70 ret_from_fork_asm+0x1a/0x30The bu---truncated---
 漏洞公开时间：2024-12-27 23:15:26
 漏洞创建时间：2025-04-10 21:34:13
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2024-56664
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/6deb9e85dc9a2ba4414b91c1b5b00b8415910890 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/b015f19fedd2e12283a8450dd0aefce49ec57015 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/b79a0d1e9a374d1b376933a354c4fcd01fce0365 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/bf2318e288f636a882eea39f7e1015623629f168 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/ed1fc5d76b81a4d681211333c026202cad4d5649 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/fdb2cd8957ac51f84c9e742ba866087944bb834b |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-56664 | https://bugzilla.suse.com/show_bug.cgi?id=1235249 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2024-56664 | https://bugzilla.suse.com/show_bug.cgi?id=1235249 |
| suse_bugzilla | https://git.kernel.org/stable/c/b015f19fedd2e12283a8450dd0aefce49ec57015 | https://bugzilla.suse.com/show_bug.cgi?id=1235249 |
| suse_bugzilla | https://git.kernel.org/stable/c/bf2318e288f636a882eea39f7e1015623629f168 | https://bugzilla.suse.com/show_bug.cgi?id=1235249 |
| suse_bugzilla | https://git.kernel.org/stable/c/ed1fc5d76b81a4d681211333c026202cad4d5649 | https://bugzilla.suse.com/show_bug.cgi?id=1235249 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2024/CVE-2024-56664.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1235249 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2334577 | https://bugzilla.suse.com/show_bug.cgi?id=1235249 |
| redhat_bugzilla | https://lore.kernel.org/linux-cve-announce/2024122752-CVE-2024-56664-9dc6@gregkh/T | https://bugzilla.redhat.com/show_bug.cgi?id=2334577 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2024-56664 |
| anolis |  | https://anas.openanolis.cn/cves/detail/CVE-2024-56664 |
| mageia |  | http://advisories.mageia.org/MGASA-2025-0030.html |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://git.kernel.org/stable/c/b015f19fedd2e12283a8450dd0aefce49ec57015 |  | nvd |
|  |  | https://git.kernel.org/stable/c/bf2318e288f636a882eea39f7e1015623629f168 |  | nvd |
|  |  | https://git.kernel.org/stable/c/ed1fc5d76b81a4d681211333c026202cad4d5649 |  | nvd |
| linux_kernel | 6.6.67 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=b015f19fedd2e12283a8450dd0aefce49ec57015Issue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=604326b41a6fb9b4a78b6179335decee0365cd8c | linuxkernelcves |
| linux_kernel | 6.12.6 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=bf2318e288f636a882eea39f7e1015623629f168Issue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=604326b41a6fb9b4a78b6179335decee0365cd8c | linuxkernelcves |
| linux_kernel | 6.13-rc3 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=ed1fc5d76b81a4d681211333c026202cad4d5649Please | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=604326b41a6fb9b4a78b6179335decee0365cd8c | linuxkernelcves |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:bpf, sockmap: Fix race between element replace and close()Element replace (with a socket different from the one stored) may racewith socket s close() link popping & unlinking. __sock_map_delete()unconditionally unrefs the (wrong) element:// set map[0] = s0map_update_elem(map, 0, s0)// drop fd of s0close(s0)  sock_map_close()    lock_sock(sk)               (s0!)    sock_map_remove_links(sk)      link = sk_psock_link_pop()      sock_map_unlink(sk, link)        sock_map_delete_from_link                                        // replace map[0] with s1                                        map_update_elem(map, 0, s1)                                          sock_map_update_elem                                (s1!)       lock_sock(sk)                                            sock_map_update_common                                              psock = sk_psock(sk)                                              spin_lock(&stab->lock)                                              osk = stab->sks[idx]                                              sock_map_add_link(..., &stab->sks[idx])                                              sock_map_unref(osk, &stab->sks[idx])                                                psock = sk_psock(osk)                                                sk_psock_put(sk, psock)                                                  if (refcount_dec_and_test(&psock))                                                    sk_psock_drop(sk, psock)                                              spin_unlock(&stab->lock)                                            unlock_sock(sk)          __sock_map_delete            spin_lock(&stab->lock)            sk = *psk                        // s1 replaced s0; sk == s1            if (!sk_test || sk_test == sk)   // sk_test (s0) != sk (s1); no branch              sk = xchg(psk, NULL)            if (sk)              sock_map_unref(sk, psk)        // unref s1; sks[idx] will dangle                psock = sk_psock(sk)                sk_psock_put(sk, psock)                  if (refcount_dec_and_test())                    sk_psock_drop(sk, psock)            spin_unlock(&stab->lock)    release_sock(sk)Then close(map) enqueues bpf_map_free_deferred, which finally callssock_map_free(). This results in some refcount_t warnings along witha KASAN splat [1].Fix __sock_map_delete(), do not allow sock_map_unref() on elements thatmay have been replaced.[1]:BUG: KASAN: slab-use-after-free in sock_map_free+0x10e/0x330Write of size 4 at addr ffff88811f5b9100 by task kworker/u64:12/1063CPU: 14 UID: 0 PID: 1063 Comm: kworker/u64:12 Not tainted 6.12.0+ #125Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.16.3-1-1 04/01/2014Workqueue: events_unbound bpf_map_free_deferredCall Trace: <TASK> dump_stack_lvl+0x68/0x90 print_report+0x174/0x4f6 kasan_report+0xb9/0x190 kasan_check_range+0x10f/0x1e0 sock_map_free+0x10e/0x330 bpf_map_free_deferred+0x173/0x320 process_one_work+0x846/0x1420 worker_thread+0x5b3/0xf80 kthread+0x29e/0x360 ret_from_fork+0x2d/0x70 ret_from_fork_asm+0x1a/0x30 </TASK>Allocated by task 1202: kasan_save_stack+0x1e/0x40 kasan_save_track+0x10/0x30 __kasan_slab_alloc+0x85/0x90 kmem_cache_alloc_noprof+0x131/0x450 sk_prot_alloc+0x5b/0x220 sk_alloc+0x2c/0x870 unix_create1+0x88/0x8a0 unix_create+0xc5/0x180 __sock_create+0x241/0x650 __sys_socketpair+0x1ce/0x420 __x64_sys_socketpair+0x92/0x100 do_syscall_64+0x93/0x180 entry_SYSCALL_64_after_hwframe+0x76/0x7eFreed by task 46: kasan_save_stack+0x1e/0x40 kasan_save_track+0x10/0x30 kasan_save_free_info+0x37/0x60 __kasan_slab_free+0x4b/0x70 kmem_cache_free+0x1a1/0x590 __sk_destruct+0x388/0x5a0 sk_psock_destroy+0x73e/0xa50 process_one_work+0x846/0x1420 worker_thread+0x5b3/0xf80 kthread+0x29e/0x360 ret_from_fork+0x2d/0x70 ret_from_fork_asm+0x1a/0x30The bu---truncated---
 openEuler评分：
  7.0
 Vector：CVSS：3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-22.03-LTS-SP3(5.10.0):受影响
2.openEuler-22.03-LTS-SP4(5.10.0):受影响
3.openEuler-24.03-LTS(6.6.0):受影响
4.openEuler-24.03-LTS-SP1(6.6.0):受影响
5.openEuler-20.03-LTS-SP4(4.19.90):不受影响
6.master(6.6.0):不受影响
7.openEuler-24.03-LTS-Next(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP4(4.19.90):否
2.openEuler-22.03-LTS-SP3(5.10.0):否
3.master(6.6.0):否
4.openEuler-24.03-LTS(6.6.0):否
5.openEuler-24.03-LTS-Next(6.6.0):否
6.openEuler-22.03-LTS-SP4(5.10.0):否
7.openEuler-24.03-LTS-SP1(6.6.0):否

原因说明：
  1.openEuler-22.03-LTS-SP3(5.10.0):正常修复
2.openEuler-22.03-LTS-SP4(5.10.0):正常修复
3.openEuler-24.03-LTS(6.6.0):正常修复
4.openEuler-24.03-LTS-SP1(6.6.0):正常修复
5.master(6.6.0):不受影响-漏洞代码不能被攻击者触发
6.openEuler-24.03-LTS-Next(6.6.0):不受影响-漏洞代码不能被攻击者触发
7.openEuler-20.03-LTS-SP4(4.19.90):不受影响-漏洞代码不存在

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2025-1450

src-openEuler/kernel
Closed

Content Risk Flag

Comments (5)

src-openEuler/kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2024-56664

Comments (5)

Search

src-openEuler/kernel
Closed