mirror of
https://github.com/fkie-cad/nvd-json-data-feeds.git
synced 2025-05-29 01:31:20 +00:00
99 lines
8.5 KiB
JSON
99 lines
8.5 KiB
JSON
{
|
|
"id": "CVE-2024-43887",
|
|
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"published": "2024-08-26T11:15:03.877",
|
|
"lastModified": "2024-09-05T19:43:44.197",
|
|
"vulnStatus": "Analyzed",
|
|
"cveTags": [],
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/tcp: Disable TCP-AO static key after RCU grace period\n\nThe lifetime of TCP-AO static_key is the same as the last\ntcp_ao_info. On the socket destruction tcp_ao_info ceases to be\nwith RCU grace period, while tcp-ao static branch is currently deferred\ndestructed. The static key definition is\n: DEFINE_STATIC_KEY_DEFERRED_FALSE(tcp_ao_needed, HZ);\n\nwhich means that if RCU grace period is delayed by more than a second\nand tcp_ao_needed is in the process of disablement, other CPUs may\nyet see tcp_ao_info which atent dead, but soon-to-be.\nAnd that breaks the assumption of static_key_fast_inc_not_disabled().\n\nSee the comment near the definition:\n> * The caller must make sure that the static key can't get disabled while\n> * in this function. It doesn't patch jump labels, only adds a user to\n> * an already enabled static key.\n\nOriginally it was introduced in commit eb8c507296f6 (\"jump_label:\nPrevent key->enabled int overflow\"), which is needed for the atomic\ncontexts, one of which would be the creation of a full socket from a\nrequest socket. In that atomic context, it's known by the presence\nof the key (md5/ao) that the static branch is already enabled.\nSo, the ref counter for that static branch is just incremented\ninstead of holding the proper mutex.\nstatic_key_fast_inc_not_disabled() is just a helper for such usage\ncase. But it must not be used if the static branch could get disabled\nin parallel as it's not protected by jump_label_mutex and as a result,\nraces with jump_label_update() implementation details.\n\nHappened on netdev test-bot[1], so not a theoretical issue:\n\n[] jump_label: Fatal kernel bug, unexpected op at tcp_inbound_hash+0x1a7/0x870 [ffffffffa8c4e9b7] (eb 50 0f 1f 44 != 66 90 0f 1f 00)) size:2 type:1\n[] ------------[ cut here ]------------\n[] kernel BUG at arch/x86/kernel/jump_label.c:73!\n[] Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI\n[] CPU: 3 PID: 243 Comm: kworker/3:3 Not tainted 6.10.0-virtme #1\n[] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014\n[] Workqueue: events jump_label_update_timeout\n[] RIP: 0010:__jump_label_patch+0x2f6/0x350\n...\n[] Call Trace:\n[] <TASK>\n[] arch_jump_label_transform_queue+0x6c/0x110\n[] __jump_label_update+0xef/0x350\n[] __static_key_slow_dec_cpuslocked.part.0+0x3c/0x60\n[] jump_label_update_timeout+0x2c/0x40\n[] process_one_work+0xe3b/0x1670\n[] worker_thread+0x587/0xce0\n[] kthread+0x28a/0x350\n[] ret_from_fork+0x31/0x70\n[] ret_from_fork_asm+0x1a/0x30\n[] </TASK>\n[] Modules linked in: veth\n[] ---[ end trace 0000000000000000 ]---\n[] RIP: 0010:__jump_label_patch+0x2f6/0x350\n\n[1]: https://netdev-3.bots.linux.dev/vmksft-tcp-ao-dbg/results/696681/5-connect-deny-ipv6/stderr"
|
|
},
|
|
{
|
|
"lang": "es",
|
|
"value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: net/tcp: deshabilite la clave est\u00e1tica TCP-AO despu\u00e9s del per\u00edodo de gracia de RCU. La vida \u00fatil de TCP-AO static_key es la misma que la del \u00faltimo tcp_ao_info. En la destrucci\u00f3n del socket, tcp_ao_info deja de tener un per\u00edodo de gracia de RCU, mientras que la rama est\u00e1tica tcp-ao actualmente se retrasa su destrucci\u00f3n. La definici\u00f3n de clave est\u00e1tica es: DEFINE_STATIC_KEY_DEFERRED_FALSE(tcp_ao_needed, HZ); lo que significa que si el per\u00edodo de gracia de la RCU se retrasa m\u00e1s de un segundo y tcp_ao_needed est\u00e1 en proceso de deshabilitaci\u00f3n, es posible que otras CPU a\u00fan vean tcp_ao_info, que est\u00e1 muerto, pero pronto lo estar\u00e1. Y eso rompe la suposici\u00f3n de static_key_fast_inc_not_disabled(). Vea el comentario cerca de la definici\u00f3n: > * El que llama debe asegurarse de que la clave est\u00e1tica no puede conseguir desactivada mientras > * est\u00e1 en esta funci\u00f3n. No parchea etiquetas de salto, s\u00f3lo agrega un usuario a > * una clave est\u00e1tica ya habilitada. Originalmente se introdujo en el commit eb8c507296f6 (\"jump_label: Prevent key->enabled int overflow\"), que es necesaria para los contextos at\u00f3micos, uno de los cuales ser\u00eda la creaci\u00f3n de un socket completo a partir de un socket de solicitud. En ese contexto at\u00f3mico, se sabe por la presencia de la clave (md5/ao) que la rama est\u00e1tica ya est\u00e1 habilitada. Entonces, el contador de referencia para esa rama est\u00e1tica simplemente se incrementa en lugar de mantener el mutex adecuado. static_key_fast_inc_not_disabled() es solo una ayuda para tal caso de uso. Pero no debe usarse si la rama est\u00e1tica podr\u00eda deshabilitarse en paralelo ya que no est\u00e1 protegida por jump_label_mutex y, como resultado, corre con los detalles de implementaci\u00f3n de jump_label_update(). Sucedi\u00f3 en netdev test-bot[1], por lo que no es un problema te\u00f3rico: [] jump_label: error fatal del kernel, operaci\u00f3n inesperada en tcp_inbound_hash+0x1a7/0x870 [ffffffffa8c4e9b7] (eb 50 0f 1f 44 != 66 90 0f 1f 00)) tama\u00f1o:2 tipo:1 [] ------------[ cortar aqu\u00ed ]------------ [] ERROR del kernel en arch/x86/kernel/jump_label.c :73! [] Ups: c\u00f3digo de operaci\u00f3n no v\u00e1lido: 0000 [#1] PREEMPT SMP KASAN NOPTI [] CPU: 3 PID: 243 Comm: kworker/3:3 Not tainted 6.10.0-virtme #1 [] Nombre del hardware: PC est\u00e1ndar QEMU (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 01/04/2014 [] Cola de trabajo: eventos jump_label_update_timeout [] RIP: 0010:__jump_label_patch+0x2f6/0x350... [] Llamada Seguimiento: [] [] arch_jump_label_transform_queue+0x6c/0x110 [] __jump_label_update+0xef/0x350 [] __static_key_slow_dec_cpuslocked.part.0+0x3c/0x60 [] jump_label_update_timeout+0x2c/0x40 [] 0x1670 [] hilo_trabajador+ 0x587/0xce0 [] kthread+0x28a/0x350 [] ret_from_fork+0x31/0x70 [] ret_from_fork_asm+0x1a/0x30 [] [] M\u00f3dulos vinculados en: veth [] ---[ end trace 0000000000000000 ]--- [] RIP: 0010:__jump_label_patch+0x2f6/0x350 [1]: https://netdev-3.bots.linux.dev/vmksft-tcp-ao-dbg/results/696681/5-connect-deny-ipv6/stderr"
|
|
}
|
|
],
|
|
"metrics": {
|
|
"cvssMetricV31": [
|
|
{
|
|
"source": "nvd@nist.gov",
|
|
"type": "Primary",
|
|
"cvssData": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
|
|
"baseScore": 4.7,
|
|
"baseSeverity": "MEDIUM",
|
|
"attackVector": "LOCAL",
|
|
"attackComplexity": "HIGH",
|
|
"privilegesRequired": "LOW",
|
|
"userInteraction": "NONE",
|
|
"scope": "UNCHANGED",
|
|
"confidentialityImpact": "NONE",
|
|
"integrityImpact": "NONE",
|
|
"availabilityImpact": "HIGH"
|
|
},
|
|
"exploitabilityScore": 1.0,
|
|
"impactScore": 3.6
|
|
}
|
|
]
|
|
},
|
|
"weaknesses": [
|
|
{
|
|
"source": "nvd@nist.gov",
|
|
"type": "Primary",
|
|
"description": [
|
|
{
|
|
"lang": "en",
|
|
"value": "NVD-CWE-noinfo"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"configurations": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.7",
|
|
"versionEndExcluding": "6.10.5",
|
|
"matchCriteriaId": "D074AE50-4A5E-499C-A2FD-75FD60DEA560"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*",
|
|
"matchCriteriaId": "8B3CE743-2126-47A3-8B7C-822B502CF119"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*",
|
|
"matchCriteriaId": "4DEB27E7-30AA-45CC-8934-B89263EF3551"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/14ab4792ee120c022f276a7e4768f4dcb08f0cdd",
|
|
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"tags": [
|
|
"Patch"
|
|
]
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/954d55a59b2501f4a9bd693b40ce45a1c46cb2b3",
|
|
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"tags": [
|
|
"Patch"
|
|
]
|
|
}
|
|
]
|
|
} |