CVE-2022-49840

一、漏洞信息
 漏洞编号：[CVE-2022-49840](https://nvd.nist.gov/vuln/detail/CVE-2022-49840)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.19,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：7.8 High
  Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:bpf, test_run: Fix alignment problem in bpf_prog_test_run_skb()We got a syzkaller problem because of aarch64 alignment faultif KFENCE enabled. When the size from user bpf program is an oddnumber, like 399, 407, etc, it will cause the struct skb_shared_info sunaligned access. As seen below:  BUG: KFENCE: use-after-free read in __skb_clone+0x23c/0x2a0 net/core/skbuff.c:1032  Use-after-free read at 0xffff6254fffac077 (in kfence-#213):   __lse_atomic_add arch/arm64/include/asm/atomic_lse.h:26 [inline]   arch_atomic_add arch/arm64/include/asm/atomic.h:28 [inline]   arch_atomic_inc include/linux/atomic-arch-fallback.h:270 [inline]   atomic_inc include/asm-generic/atomic-instrumented.h:241 [inline]   __skb_clone+0x23c/0x2a0 net/core/skbuff.c:1032   skb_clone+0xf4/0x214 net/core/skbuff.c:1481   ____bpf_clone_redirect net/core/filter.c:2433 [inline]   bpf_clone_redirect+0x78/0x1c0 net/core/filter.c:2420   bpf_prog_d3839dd9068ceb51+0x80/0x330   bpf_dispatcher_nop_func include/linux/bpf.h:728 [inline]   bpf_test_run+0x3c0/0x6c0 net/bpf/test_run.c:53   bpf_prog_test_run_skb+0x638/0xa7c net/bpf/test_run.c:594   bpf_prog_test_run kernel/bpf/syscall.c:3148 [inline]   __do_sys_bpf kernel/bpf/syscall.c:4441 [inline]   __se_sys_bpf+0xad0/0x1634 kernel/bpf/syscall.c:4381  kfence-#213: 0xffff6254fffac000-0xffff6254fffac196, size=407, cache=kmalloc-512  allocated by task 15074 on cpu 0 at 1342.585390s:   kmalloc include/linux/slab.h:568 [inline]   kzalloc include/linux/slab.h:675 [inline]   bpf_test_init.isra.0+0xac/0x290 net/bpf/test_run.c:191   bpf_prog_test_run_skb+0x11c/0xa7c net/bpf/test_run.c:512   bpf_prog_test_run kernel/bpf/syscall.c:3148 [inline]   __do_sys_bpf kernel/bpf/syscall.c:4441 [inline]   __se_sys_bpf+0xad0/0x1634 kernel/bpf/syscall.c:4381   __arm64_sys_bpf+0x50/0x60 kernel/bpf/syscall.c:4381To fix the problem, we adjust @size so that (@size + @hearoom) is amultiple of SMP_CACHE_BYTES. So we make sure the struct skb_shared_infois aligned to a cache line.
 漏洞公开时间：2025-05-01 23:16:07
 漏洞创建时间：2025-05-02 00:23:00
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2022-49840
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/047824a730699c6c66df43306b80f700c9dfc2fd |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/1b597f2d6a55e9f549989913860ad5170da04964 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/730fb1ef974a13915bc7651364d8b3318891cd70 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/7a704dbfd3735304e261f2787c52fbc7c3884736 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/d3fd203f36d46aa29600a72d57a1b61af80e4a25 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/e60f37a1d379c821c17b08f366412dce9ef3d99f |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/eaa8edd86514afac9deb9bf9a5053e74f37edf40 |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-49840 | https://bugzilla.suse.com/show_bug.cgi?id=1242447 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2022-49840 | https://bugzilla.suse.com/show_bug.cgi?id=1242447 |
| suse_bugzilla | https://git.kernel.org/stable/c/047824a730699c6c66df43306b80f700c9dfc2fd | https://bugzilla.suse.com/show_bug.cgi?id=1242447 |
| suse_bugzilla | https://git.kernel.org/stable/c/1b597f2d6a55e9f549989913860ad5170da04964 | https://bugzilla.suse.com/show_bug.cgi?id=1242447 |
| suse_bugzilla | https://git.kernel.org/stable/c/730fb1ef974a13915bc7651364d8b3318891cd70 | https://bugzilla.suse.com/show_bug.cgi?id=1242447 |
| suse_bugzilla | https://git.kernel.org/stable/c/7a704dbfd3735304e261f2787c52fbc7c3884736 | https://bugzilla.suse.com/show_bug.cgi?id=1242447 |
| suse_bugzilla | https://git.kernel.org/stable/c/d3fd203f36d46aa29600a72d57a1b61af80e4a25 | https://bugzilla.suse.com/show_bug.cgi?id=1242447 |
| suse_bugzilla | https://git.kernel.org/stable/c/e60f37a1d379c821c17b08f366412dce9ef3d99f | https://bugzilla.suse.com/show_bug.cgi?id=1242447 |
| suse_bugzilla | https://git.kernel.org/stable/c/eaa8edd86514afac9deb9bf9a5053e74f37edf40 | https://bugzilla.suse.com/show_bug.cgi?id=1242447 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2022/CVE-2022-49840.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1242447 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2363527 | https://bugzilla.suse.com/show_bug.cgi?id=1242447 |
| redhat_bugzilla | https://lore.kernel.org/linux-cve-announce/2025050140-CVE-2022-49840-5186@gregkh/T | https://bugzilla.redhat.com/show_bug.cgi?id=2363527 |
| anolis |  | https://anas.openanolis.cn/cves/detail/CVE-2022-49840 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://git.kernel.org/stable/c/047824a730699c6c66df43306b80f700c9dfc2fd |  | nvd |
|  |  | https://git.kernel.org/stable/c/1b597f2d6a55e9f549989913860ad5170da04964 |  | nvd |
|  |  | https://git.kernel.org/stable/c/730fb1ef974a13915bc7651364d8b3318891cd70 |  | nvd |
|  |  | https://git.kernel.org/stable/c/7a704dbfd3735304e261f2787c52fbc7c3884736 |  | nvd |
|  |  | https://git.kernel.org/stable/c/d3fd203f36d46aa29600a72d57a1b61af80e4a25 |  | nvd |
|  |  | https://git.kernel.org/stable/c/e60f37a1d379c821c17b08f366412dce9ef3d99f |  | nvd |
|  |  | https://git.kernel.org/stable/c/eaa8edd86514afac9deb9bf9a5053e74f37edf40 |  | nvd |
| linux_kernel | 4.14.300 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=047824a730699c6c66df43306b80f700c9dfc2fd | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1cf1cae963c2e6032aebe1637e995bc2f5d330f4 | linuxkernelcves |
| linux_kernel | 4.19.267 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=730fb1ef974a13915bc7651364d8b3318891cd70 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1cf1cae963c2e6032aebe1637e995bc2f5d330f4 | linuxkernelcves |
| linux_kernel | 5.4.225 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=7a704dbfd3735304e261f2787c52fbc7c3884736 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1cf1cae963c2e6032aebe1637e995bc2f5d330f4 | linuxkernelcves |
| linux_kernel | 5.10.156 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=e60f37a1d379c821c17b08f366412dce9ef3d99f | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1cf1cae963c2e6032aebe1637e995bc2f5d330f4 | linuxkernelcves |
| linux_kernel | 5.15.80 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=eaa8edd86514afac9deb9bf9a5053e74f37edf40 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1cf1cae963c2e6032aebe1637e995bc2f5d330f4 | linuxkernelcves |
| linux_kernel | 6.0.10 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1b597f2d6a55e9f549989913860ad5170da04964 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1cf1cae963c2e6032aebe1637e995bc2f5d330f4 | linuxkernelcves |
| linux_kernel | 6.1 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=d3fd203f36d46aa29600a72d57a1b61af80e4a25 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1cf1cae963c2e6032aebe1637e995bc2f5d330f4 | linuxkernelcves |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:bpf, test_run: Fix alignment problem in bpf_prog_test_run_skb()We got a syzkaller problem because of aarch64 alignment faultif KFENCE enabled. When the size from user bpf program is an oddnumber, like 399, 407, etc, it will cause the struct skb_shared_info&#39;sunaligned access. As seen below:  BUG: KFENCE: use-after-free read in __skb_clone+0x23c/0x2a0 net/core/skbuff.c:1032  Use-after-free read at 0xffff6254fffac077 (in kfence-#213):   __lse_atomic_add arch/arm64/include/asm/atomic_lse.h:26 [inline]   arch_atomic_add arch/arm64/include/asm/atomic.h:28 [inline]   arch_atomic_inc include/linux/atomic-arch-fallback.h:270 [inline]   atomic_inc include/asm-generic/atomic-instrumented.h:241 [inline]   __skb_clone+0x23c/0x2a0 net/core/skbuff.c:1032   skb_clone+0xf4/0x214 net/core/skbuff.c:1481   ____bpf_clone_redirect net/core/filter.c:2433 [inline]   bpf_clone_redirect+0x78/0x1c0 net/core/filter.c:2420   bpf_prog_d3839dd9068ceb51+0x80/0x330   bpf_dispatcher_nop_func include/linux/bpf.h:728 [inline]   bpf_test_run+0x3c0/0x6c0 net/bpf/test_run.c:53   bpf_prog_test_run_skb+0x638/0xa7c net/bpf/test_run.c:594   bpf_prog_test_run kernel/bpf/syscall.c:3148 [inline]   __do_sys_bpf kernel/bpf/syscall.c:4441 [inline]   __se_sys_bpf+0xad0/0x1634 kernel/bpf/syscall.c:4381  kfence-#213: 0xffff6254fffac000-0xffff6254fffac196, size=407, cache=kmalloc-512  allocated by task 15074 on cpu 0 at 1342.585390s:   kmalloc include/linux/slab.h:568 [inline]   kzalloc include/linux/slab.h:675 [inline]   bpf_test_init.isra.0+0xac/0x290 net/bpf/test_run.c:191   bpf_prog_test_run_skb+0x11c/0xa7c net/bpf/test_run.c:512   bpf_prog_test_run kernel/bpf/syscall.c:3148 [inline]   __do_sys_bpf kernel/bpf/syscall.c:4441 [inline]   __se_sys_bpf+0xad0/0x1634 kernel/bpf/syscall.c:4381   __arm64_sys_bpf+0x50/0x60 kernel/bpf/syscall.c:4381To fix the problem, we adjust @size so that (@size + @hearoom) is amultiple of SMP_CACHE_BYTES. So we make sure the struct skb_shared_infois aligned to a cache line.The Linux kernel CVE team has assigned CVE-2022-49840 to this issue.
 openEuler评分：
  7.8
 Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP4(4.19.90):受影响
2.master(6.6.0):不受影响
3.openEuler-22.03-LTS-SP3(5.10.0):不受影响
4.openEuler-22.03-LTS-SP4(5.10.0):不受影响
5.openEuler-24.03-LTS(6.6.0):不受影响
6.openEuler-24.03-LTS-Next(6.6.0):不受影响
7.openEuler-24.03-LTS-SP1(6.6.0):不受影响
8.openEuler-24.03-LTS-SP2(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.master(6.6.0):否
2.openEuler-20.03-LTS-SP4(4.19.90):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.openEuler-22.03-LTS-SP4(5.10.0):否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-24.03-LTS-SP1(6.6.0):否
8.openEuler-24.03-LTS-SP2(6.6.0):否

原因说明：
  1.openEuler-20.03-LTS-SP4(4.19.90):正常修复
2.master(6.6.0):不受影响-漏洞代码不能被攻击者触发
3.openEuler-22.03-LTS-SP3(5.10.0):不受影响-漏洞代码不能被攻击者触发
4.openEuler-22.03-LTS-SP4(5.10.0):不受影响-漏洞代码不能被攻击者触发
5.openEuler-24.03-LTS(6.6.0):不受影响-漏洞代码不能被攻击者触发
6.openEuler-24.03-LTS-Next(6.6.0):不受影响-漏洞代码不能被攻击者触发
7.openEuler-24.03-LTS-SP1(6.6.0):不受影响-漏洞代码不能被攻击者触发
8.openEuler-24.03-LTS-SP2(6.6.0):不受影响-漏洞代码不能被攻击者触发

Hi openeuler-ci-bot, welcome to the openEuler Community.
I'm the Bot here serving you. You can find the instructions on how to interact with me at Here.
If you have any questions, please contact the SIG: Kernel, and any of the maintainers.

@yangyingliang ,@jiaoff ,@guohaocs2c ,@hanjun-guo ,@woqidaideshi ,@newbeats ,@zhangyi089 ,@colyli ,@thundertown ,@htforge ,@chiqijun ,@lengchao ,@zhujianwei001 ,@kylin-mayukun ,@wangxiongfeng ,@wkfxxx ,@SuperSix173 ,@jentlestea ,@oskernel0719 ,@gasonchen 
**issue处理注意事项:** 
**1. 当前issue受影响的分支提交pr时, 须在pr描述中填写当前issue编号进行关联, 否则无法关闭当前issue;**
**2. 模板内容需要填写完整, 无论是受影响或者不受影响都需要填写完整内容,未引入的分支不需要填写, 否则无法关闭当前issue;**
**3. 以下为模板中需要填写完整的内容, 请复制到评论区回复, 注: 内容的标题名称(影响性分析说明, openEuler评分, 受影响版本排查(受影响/不受影响), 修复是否涉及abi变化(是/否), 原因说明)不能省略,省略后cve-manager将无法正常解析填写内容.**
************************************************************************
影响性分析说明:

openEuler评分: (评分和向量)

受影响版本排查(受影响/不受影响): 
1.master(6.6.0):
2.openEuler-20.03-LTS-SP4(4.19.90):
3.openEuler-22.03-LTS-SP3(5.10.0):
4.openEuler-22.03-LTS-SP4(5.10.0):
5.openEuler-24.03-LTS(6.6.0):
6.openEuler-24.03-LTS-Next(6.6.0):
7.openEuler-24.03-LTS-SP1(6.6.0):
8.openEuler-24.03-LTS-SP2(6.6.0):

修复是否涉及abi变化(是/否)：
1.master(6.6.0):
2.openEuler-20.03-LTS-SP4(4.19.90):
3.openEuler-22.03-LTS-SP3(5.10.0):
4.openEuler-22.03-LTS-SP4(5.10.0):
5.openEuler-24.03-LTS(6.6.0):
6.openEuler-24.03-LTS-Next(6.6.0):
7.openEuler-24.03-LTS-SP1(6.6.0):
8.openEuler-24.03-LTS-SP2(6.6.0):

原因说明：
1.master(6.6.0):
2.openEuler-20.03-LTS-SP4(4.19.90):
3.openEuler-22.03-LTS-SP3(5.10.0):
4.openEuler-22.03-LTS-SP4(5.10.0):
5.openEuler-24.03-LTS(6.6.0):
6.openEuler-24.03-LTS-Next(6.6.0):
7.openEuler-24.03-LTS-SP1(6.6.0):
8.openEuler-24.03-LTS-SP2(6.6.0):

issue处理具体操作请参考: 
https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
pr关联issue具体操作请参考:
https://gitee.com/help/articles/4142

参考网址	关联pr	状态	补丁链接
https://nvd.nist.gov/vuln/detail/CVE-2022-49840	None	None	https://git.kernel.org/stable/c/730fb1ef974a13915bc7651364d8b3318891cd70 https://git.kernel.org/stable/c/047824a730699c6c66df43306b80f700c9dfc2fd https://git.kernel.org/stable/c/eaa8edd86514afac9deb9bf9a5053e74f37edf40 https://git.kernel.org/stable/c/7a704dbfd3735304e261f2787c52fbc7c3884736 https://git.kernel.org/stable/c/d3fd203f36d46aa29600a72d57a1b61af80e4a25 https://git.kernel.org/stable/c/e60f37a1d379c821c17b08f366412dce9ef3d99f https://git.kernel.org/stable/c/1b597f2d6a55e9f549989913860ad5170da04964
https://ubuntu.com/security/CVE-2022-49840
https://www.opencve.io/cve/CVE-2022-49840	None	None	https://git.kernel.org/stable/c/730fb1ef974a13915bc7651364d8b3318891cd70 https://git.kernel.org/stable/c/047824a730699c6c66df43306b80f700c9dfc2fd https://git.kernel.org/stable/c/eaa8edd86514afac9deb9bf9a5053e74f37edf40 https://git.kernel.org/stable/c/7a704dbfd3735304e261f2787c52fbc7c3884736 https://git.kernel.org/stable/c/d3fd203f36d46aa29600a72d57a1b61af80e4a25 https://git.kernel.org/stable/c/e60f37a1d379c821c17b08f366412dce9ef3d99f https://git.kernel.org/stable/c/1b597f2d6a55e9f549989913860ad5170da04964
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2022-49840
https://security-tracker.debian.org/tracker/CVE-2022-49840
http://www.cnnvd.org.cn/web/vulnerability/queryLds.tag?qcvCnnvdid=CVE-2022-49840

说明：补丁链接仅供初步排查参考，实际可用性请人工再次确认，补丁下载验证可使用CVE补丁工具。
若补丁不准确，烦请在此issue下评论 '/report-patch 参考网址补丁链接1,补丁链接2' 反馈正确信息，便于我们不断优化工具，不胜感激。
如 /report-patch https://security-tracker.debian.org/tracker/CVE-2021-3997 https://github.com/systemd/systemd/commit/5b1cf7a9be37e20133c0208005274ce4a5b5c6a1

CVE-2022-49840

影响性分析说明：
In the Linux kernel, the following vulnerability has been resolved:

bpf, test_run: Fix alignment problem in bpf_prog_test_run_skb()

We got a syzkaller problem because of aarch64 alignment fault
if KFENCE enabled. When the size from user bpf program is an odd
number, like 399, 407, etc, it will cause the struct skb_shared_info&#39;s
unaligned access. As seen below:

BUG: KFENCE: use-after-free read in __skb_clone+0x23c/0x2a0 net/core/skbuff.c:1032

Use-after-free read at 0xffff6254fffac077 (in kfence-#213):
   __lse_atomic_add arch/arm64/include/asm/atomic_lse.h:26 [inline]
   arch_atomic_add arch/arm64/include/asm/atomic.h:28 [inline]
   arch_atomic_inc include/linux/atomic-arch-fallback.h:270 [inline]
   atomic_inc include/asm-generic/atomic-instrumented.h:241 [inline]
   __skb_clone+0x23c/0x2a0 net/core/skbuff.c:1032
   skb_clone+0xf4/0x214 net/core/skbuff.c:1481
   ____bpf_clone_redirect net/core/filter.c:2433 [inline]
   bpf_clone_redirect+0x78/0x1c0 net/core/filter.c:2420
   bpf_prog_d3839dd9068ceb51+0x80/0x330
   bpf_dispatcher_nop_func include/linux/bpf.h:728 [inline]
   bpf_test_run+0x3c0/0x6c0 net/bpf/test_run.c:53
   bpf_prog_test_run_skb+0x638/0xa7c net/bpf/test_run.c:594
   bpf_prog_test_run kernel/bpf/syscall.c:3148 [inline]
   __do_sys_bpf kernel/bpf/syscall.c:4441 [inline]
   __se_sys_bpf+0xad0/0x1634 kernel/bpf/syscall.c:4381

kfence-#213: 0xffff6254fffac000-0xffff6254fffac196, size=407, cache=kmalloc-512

allocated by task 15074 on cpu 0 at 1342.585390s:
   kmalloc include/linux/slab.h:568 [inline]
   kzalloc include/linux/slab.h:675 [inline]
   bpf_test_init.isra.0+0xac/0x290 net/bpf/test_run.c:191
   bpf_prog_test_run_skb+0x11c/0xa7c net/bpf/test_run.c:512
   bpf_prog_test_run kernel/bpf/syscall.c:3148 [inline]
   __do_sys_bpf kernel/bpf/syscall.c:4441 [inline]
   __se_sys_bpf+0xad0/0x1634 kernel/bpf/syscall.c:4381
   __arm64_sys_bpf+0x50/0x60 kernel/bpf/syscall.c:4381

To fix the problem, we adjust @size so that (@size + @hearoom) is a
multiple of SMP_CACHE_BYTES. So we make sure the struct skb_shared_info
is aligned to a cache line.

The Linux kernel CVE team has assigned CVE-2022-49840 to this issue.

openEuler评分:(评分和向量)
7.8
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

受影响版本排查(受影响/不受影响):
1.master(6.1.0):不受影响
2.openEuler-20.03-LTS-SP4:受影响
3.openEuler-22.03-LTS-SP3:不受影响
4.openEuler-22.03-LTS-SP4:不受影响
5.openEuler-24.03-LTS:不受影响
6.openEuler-24.03-LTS-Next:不受影响
7.openEuler-24.03-LTS-SP1:不受影响
8.openEuler-24.03-LTS-SP2:不受影响

修复是否涉及abi变化(是/否)：
1.master(6.1.0):否
2.openEuler-20.03-LTS-SP4:否
3.openEuler-22.03-LTS-SP3:否
4.openEuler-22.03-LTS-SP4:否
5.openEuler-24.03-LTS:否
6.openEuler-24.03-LTS-Next:否
7.openEuler-24.03-LTS-SP1:否
8.openEuler-24.03-LTS-SP2:否

原因说明：
1.master(23.08.5):不受影响-漏洞代码不能被攻击者触发
2.openEuler-20.03-LTS-SP4:正常修复
3.openEuler-22.03-LTS-SP3:不受影响-漏洞代码不能被攻击者触发
4.openEuler-22.03-LTS-SP4:不受影响-漏洞代码不能被攻击者触发
5.openEuler-24.03-LTS:不受影响-漏洞代码不能被攻击者触发
6.openEuler-24.03-LTS-Next:不受影响-漏洞代码不能被攻击者触发
7.openEuler-24.03-LTS-SP1:不受影响-漏洞代码不能被攻击者触发
8.openEuler-24.03-LTS-SP2:不受影响-漏洞代码不能被攻击者触发

@CTC-XiboWang 经过 cve-manager 解析, 已分析的内容如下表所示:
| 状态  | 分析项目 | 内容 |
|:--:|:--:|---------|
|已分析|1.影响性分析说明|In the Linux kernel, the following vulnerability has been resolved:bpf, test_run: Fix alignment problem in bpf_prog_test_run_skb()We got a syzkaller problem because of aarch64 alignment faultif KFENCE enabled. When the size from user bpf program is an oddnumber, like 399, 407, etc, it will cause the struct skb_shared_info&#39;sunaligned access. As seen below:  BUG: KFENCE: use-after-free read in __skb_clone+0x23c/0x2a0 net/core/skbuff.c:1032  Use-after-free read at 0xffff6254fffac077 (in kfence-#213):   __lse_atomic_add arch/arm64/include/asm/atomic_lse.h:26 [inline]   arch_atomic_add arch/arm64/include/asm/atomic.h:28 [inline]   arch_atomic_inc include/linux/atomic-arch-fallback.h:270 [inline]   atomic_inc include/asm-generic/atomic-instrumented.h:241 [inline]   __skb_clone+0x23c/0x2a0 net/core/skbuff.c:1032   skb_clone+0xf4/0x214 net/core/skbuff.c:1481   ____bpf_clone_redirect net/core/filter.c:2433 [inline]   bpf_clone_redirect+0x78/0x1c0 net/core/filter.c:2420   bpf_prog_d3839dd9068ceb51+0x80/0x330   bpf_dispatcher_nop_func include/linux/bpf.h:728 [inline]   bpf_test_run+0x3c0/0x6c0 net/bpf/test_run.c:53   bpf_prog_test_run_skb+0x638/0xa7c net/bpf/test_run.c:594   bpf_prog_test_run kernel/bpf/syscall.c:3148 [inline]   __do_sys_bpf kernel/bpf/syscall.c:4441 [inline]   __se_sys_bpf+0xad0/0x1634 kernel/bpf/syscall.c:4381  kfence-#213: 0xffff6254fffac000-0xffff6254fffac196, size=407, cache=kmalloc-512  allocated by task 15074 on cpu 0 at 1342.585390s:   kmalloc include/linux/slab.h:568 [inline]   kzalloc include/linux/slab.h:675 [inline]   bpf_test_init.isra.0+0xac/0x290 net/bpf/test_run.c:191   bpf_prog_test_run_skb+0x11c/0xa7c net/bpf/test_run.c:512   bpf_prog_test_run kernel/bpf/syscall.c:3148 [inline]   __do_sys_bpf kernel/bpf/syscall.c:4441 [inline]   __se_sys_bpf+0xad0/0x1634 kernel/bpf/syscall.c:4381   __arm64_sys_bpf+0x50/0x60 kernel/bpf/syscall.c:4381To fix the problem, we adjust @size so that (@size + @hearoom) is amultiple of SMP_CACHE_BYTES. So we make sure the struct skb_shared_infois aligned to a cache line.The Linux kernel CVE team has assigned CVE-2022-49840 to this issue.|
|已分析|2.openEulerScore|7.8|
|已分析|3.openEulerVector|AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H|
|已分析|4.受影响版本排查|openEuler-20.03-LTS-SP4:受影响,master:不受影响,openEuler-22.03-LTS-SP3:不受影响,openEuler-22.03-LTS-SP4:不受影响,openEuler-24.03-LTS:不受影响,openEuler-24.03-LTS-Next:不受影响,openEuler-24.03-LTS-SP1:不受影响,openEuler-24.03-LTS-SP2:不受影响|
|已分析|5.是否涉及abi变化|master:否,openEuler-20.03-LTS-SP4:否,openEuler-22.03-LTS-SP3:否,openEuler-22.03-LTS-SP4:否,openEuler-24.03-LTS:否,openEuler-24.03-LTS-Next:否,openEuler-24.03-LTS-SP1:否,openEuler-24.03-LTS-SP2:否|
|已分析|6.原因说明|openEuler-20.03-LTS-SP4:正常修复,master:不受影响-漏洞代码不能被攻击者触发,openEuler-22.03-LTS-SP3:不受影响-漏洞代码不能被攻击者触发,openEuler-22.03-LTS-SP4:不受影响-漏洞代码不能被攻击者触发,openEuler-24.03-LTS:不受影响-漏洞代码不能被攻击者触发,openEuler-24.03-LTS-Next:不受影响-漏洞代码不能被攻击者触发,openEuler-24.03-LTS-SP1:不受影响-漏洞代码不能被攻击者触发,openEuler-24.03-LTS-SP2:不受影响-漏洞代码不能被攻击者触发|

**请确认分析内容的准确性, 确认无误后, 您可以进行后续步骤, 否则您可以继续分析.**

src-openEuler/kernel

内容风险标识

评论 (5)

src-openEuler/kernel .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2022-49840

评论 (5)

搜索帮助

src-openEuler/kernel