CVE-2024-27050

一、漏洞信息
 漏洞编号：[CVE-2024-27050](https://nvd.nist.gov/vuln/detail/CVE-2024-27050)
 漏洞归属组件：[libbpf](https://gitee.com/src-openeuler/libbpf)
 漏洞归属的版本：0.1.1,0.3,1.2.2
 CVSS V3.0分值：
  BaseScore：5.5 Medium
  Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:libbpf: Use OPTS_SET() macro in bpf_xdp_query()When the feature_flags and xdp_zc_max_segs fields were added to the libbpfbpf_xdp_query_opts, the code writing them did not use the OPTS_SET() macro.This causes libbpf to write to those fields unconditionally, which meansthat programs compiled against an older version of libbpf (with a smallersize of the bpf_xdp_query_opts struct) will have its stack corrupted bylibbpf writing out of bounds.The patch adding the feature_flags field has an early bail out if thefeature_flags field is not part of the opts struct (via the OPTS_HAS)macro, but the patch adding xdp_zc_max_segs does not. For consistency, thisfix just changes the assignments to both fields to use the OPTS_SET()macro.
 漏洞公开时间：2024-05-01 21:15:50
 漏洞创建时间：2025-05-08 16:59:14
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2024-27050
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/682ddd62abd4bdcee7584246903e7a2df005fe0d |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/92a871ab9fa59a74d013bc04f321026a057618e7 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/cd3be9843247edb8fc6fcd8d8237cbce2bc19f5e |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/fa5bef5e80c6a3321b2b1a7070436f3bc5daf07c |  |
| af854a3a-2127-422b-91ae-364da2661108 | https://git.kernel.org/stable/c/682ddd62abd4bdcee7584246903e7a2df005fe0d |  |
| af854a3a-2127-422b-91ae-364da2661108 | https://git.kernel.org/stable/c/92a871ab9fa59a74d013bc04f321026a057618e7 |  |
| af854a3a-2127-422b-91ae-364da2661108 | https://git.kernel.org/stable/c/cd3be9843247edb8fc6fcd8d8237cbce2bc19f5e |  |
| af854a3a-2127-422b-91ae-364da2661108 | https://git.kernel.org/stable/c/fa5bef5e80c6a3321b2b1a7070436f3bc5daf07c |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-27050 | https://bugzilla.suse.com/show_bug.cgi?id=1223767 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2024-27050 | https://bugzilla.suse.com/show_bug.cgi?id=1223767 |
| suse_bugzilla | https://git.kernel.org/stable/c/682ddd62abd4bdcee7584246903e7a2df005fe0d | https://bugzilla.suse.com/show_bug.cgi?id=1223767 |
| suse_bugzilla | https://git.kernel.org/stable/c/92a871ab9fa59a74d013bc04f321026a057618e7 | https://bugzilla.suse.com/show_bug.cgi?id=1223767 |
| suse_bugzilla | https://git.kernel.org/stable/c/cd3be9843247edb8fc6fcd8d8237cbce2bc19f5e | https://bugzilla.suse.com/show_bug.cgi?id=1223767 |
| suse_bugzilla | https://git.kernel.org/stable/c/fa5bef5e80c6a3321b2b1a7070436f3bc5daf07c | https://bugzilla.suse.com/show_bug.cgi?id=1223767 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2024/CVE-2024-27050.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1223767 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2278427 | https://bugzilla.suse.com/show_bug.cgi?id=1223767 |
| redhat_bugzilla | https://lore.kernel.org/linux-cve-announce/2024050114-CVE-2024-27050-b829@gregkh/T | https://bugzilla.redhat.com/show_bug.cgi?id=2278427 |
| ubuntu | https://www.cve.org/CVERecord?id=CVE-2024-27050 | https://ubuntu.com/security/CVE-2024-27050 |
| ubuntu | https://git.kernel.org/linus/92a871ab9fa59a74d013bc04f321026a057618e7 (6.9-rc1) | https://ubuntu.com/security/CVE-2024-27050 |
| ubuntu | https://git.kernel.org/stable/c/fa5bef5e80c6a3321b2b1a7070436f3bc5daf07c | https://ubuntu.com/security/CVE-2024-27050 |
| ubuntu | https://git.kernel.org/stable/c/682ddd62abd4bdcee7584246903e7a2df005fe0d | https://ubuntu.com/security/CVE-2024-27050 |
| ubuntu | https://git.kernel.org/stable/c/cd3be9843247edb8fc6fcd8d8237cbce2bc19f5e | https://ubuntu.com/security/CVE-2024-27050 |
| ubuntu | https://git.kernel.org/stable/c/92a871ab9fa59a74d013bc04f321026a057618e7 | https://ubuntu.com/security/CVE-2024-27050 |
| ubuntu | https://ubuntu.com/security/notices/USN-6816-1 | https://ubuntu.com/security/CVE-2024-27050 |
| ubuntu | https://ubuntu.com/security/notices/USN-6817-1 | https://ubuntu.com/security/CVE-2024-27050 |
| ubuntu | https://ubuntu.com/security/notices/USN-6817-2 | https://ubuntu.com/security/CVE-2024-27050 |
| ubuntu | https://ubuntu.com/security/notices/USN-6817-3 | https://ubuntu.com/security/CVE-2024-27050 |
| ubuntu | https://nvd.nist.gov/vuln/detail/CVE-2024-27050 | https://ubuntu.com/security/CVE-2024-27050 |
| ubuntu | https://launchpad.net/bugs/cve/CVE-2024-27050 | https://ubuntu.com/security/CVE-2024-27050 |
| ubuntu | https://security-tracker.debian.org/tracker/CVE-2024-27050 | https://ubuntu.com/security/CVE-2024-27050 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2024-27050 |
| anolis |  | https://anas.openanolis.cn/cves/detail/CVE-2024-27050 |
| cve_search |  | https://git.kernel.org/stable/c/fa5bef5e80c6a3321b2b1a7070436f3bc5daf07c |
| cve_search |  | https://git.kernel.org/stable/c/682ddd62abd4bdcee7584246903e7a2df005fe0d |
| cve_search |  | https://git.kernel.org/stable/c/cd3be9843247edb8fc6fcd8d8237cbce2bc19f5e |
| cve_search |  | https://git.kernel.org/stable/c/92a871ab9fa59a74d013bc04f321026a057618e7 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://git.kernel.org/stable/c/682ddd62abd4bdcee7584246903e7a2df005fe0d |  | nvd |
|  |  | https://git.kernel.org/stable/c/92a871ab9fa59a74d013bc04f321026a057618e7 |  | nvd |
|  |  | https://git.kernel.org/stable/c/cd3be9843247edb8fc6fcd8d8237cbce2bc19f5e |  | nvd |
|  |  | https://git.kernel.org/stable/c/fa5bef5e80c6a3321b2b1a7070436f3bc5daf07c |  | nvd |
| linux |  | https://git.kernel.org/linus/92a871ab9fa59a74d013bc04f321026a057618e7 | https://git.kernel.org/linus/13ce2daa259a3bfbc9a5aeeee8b9a87058703731 | ubuntu |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  libbpf新增feature_flags和xdp_zc_max_segs字段bpf_xdp_query_opts，编写它们的代码没有使用OPTS_SET()宏。这将导致libbpf无条件地写入这些字段，这意味着程序编译时使用较旧版本的libbpf (使用较小的libbpf bpf_xdp_query_opts结构体的大小)将导致其堆栈损坏libbpf写入越界。
 openEuler评分：
  5.5
 Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.master(1.2.2):受影响
2.openEuler-24.03-LTS(1.2.2):受影响
3.openEuler-24.03-LTS-Next(1.2.2):受影响
4.openEuler-24.03-LTS-SP1(1.2.2):受影响
5.openEuler-24.03-LTS-SP2(1.2.2):受影响
6.openEuler-20.03-LTS-SP4(0.3):不受影响
7.openEuler-22.03-LTS-SP3(0.8.1):不受影响
8.openEuler-22.03-LTS-SP4(0.8.1):不受影响

修复是否涉及abi变化(是/否)：
  1.master(1.2.2):否
2.openEuler-20.03-LTS-SP4(0.3):否
3.openEuler-22.03-LTS-SP3(0.8.1):否
4.openEuler-22.03-LTS-SP4(0.8.1):否
5.openEuler-24.03-LTS(1.2.2):否
6.openEuler-24.03-LTS-Next(1.2.2):否
7.openEuler-24.03-LTS-SP1(1.2.2):否
8.openEuler-24.03-LTS-SP2(1.2.2):否

原因说明：
  1.master(1.2.2):正常修复
2.openEuler-24.03-LTS(1.2.2):正常修复
3.openEuler-24.03-LTS-Next(1.2.2):正常修复
4.openEuler-24.03-LTS-SP1(1.2.2):正常修复
5.openEuler-24.03-LTS-SP2(1.2.2):正常修复
6.openEuler-20.03-LTS-SP4(0.3):不受影响-漏洞代码不存在
7.openEuler-22.03-LTS-SP3(0.8.1):不受影响-漏洞代码不存在
8.openEuler-22.03-LTS-SP4(0.8.1):不受影响-漏洞代码不存在

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2025-1577

src-openEuler/libbpf
关闭

内容风险标识

评论 (12)

src-openEuler/libbpf关闭 .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2024-27050

评论 (12)

搜索帮助

src-openEuler/libbpf
关闭