kernel-5.14.0-503.14.1.el9_5
エラータID: AXSA:2024-9508:43
リリース日:
2024/12/26 Thursday - 09:26
題名:
kernel-5.14.0-503.14.1.el9_5
影響のあるチャネル:
MIRACLE LINUX 9 for x86_64
Severity:
Moderate
Description:
以下項目について対処しました。
[Security Fix]
- net/ipv4/nexthop.c の nla_put_nh_group() 関数には、
nexthop_grp 構造体の初期化処理が欠落しているため、
ローカルの攻撃者により、サービス拒否攻撃を可能とする
脆弱性が存在します。(CVE-2024-42283)
- drivers/iommu/iommufd/hw_pagetable.c の
iommufd_hwpt_nested_alloc() 関数には、ポインタ値の
チェック処理漏れに起因した NULL ポインタデリファレンス
の問題があるため、ローカルの攻撃者により、サービス拒否
攻撃を可能とする脆弱性が存在します。(CVE-2024-46824)
- net/mptcp/pm_netlink.c には、レースコンディションに起因
したメモリ領域の解放後利用の問題があるため、ローカルの
攻撃者により、サービス拒否攻撃を可能とする脆弱性が存在
します。(CVE-2024-46858)
解決策:
パッケージをアップデートしてください。
CVE:
CVE-2024-42283
In the Linux kernel, the following vulnerability has been resolved: net: nexthop: Initialize all fields in dumped nexthops struct nexthop_grp contains two reserved fields that are not initialized by nla_put_nh_group(), and carry garbage. This can be observed e.g. with strace (edited for clarity): # ip nexthop add id 1 dev lo # ip nexthop add id 101 group 1 # strace -e recvmsg ip nexthop get id 101 ... recvmsg(... [{nla_len=12, nla_type=NHA_GROUP}, [{id=1, weight=0, resvd1=0x69, resvd2=0x67}]] ...) = 52 The fields are reserved and therefore not currently used. But as they are, they leak kernel memory, and the fact they are not just zero complicates repurposing of the fields for new ends. Initialize the full structure.
In the Linux kernel, the following vulnerability has been resolved: net: nexthop: Initialize all fields in dumped nexthops struct nexthop_grp contains two reserved fields that are not initialized by nla_put_nh_group(), and carry garbage. This can be observed e.g. with strace (edited for clarity): # ip nexthop add id 1 dev lo # ip nexthop add id 101 group 1 # strace -e recvmsg ip nexthop get id 101 ... recvmsg(... [{nla_len=12, nla_type=NHA_GROUP}, [{id=1, weight=0, resvd1=0x69, resvd2=0x67}]] ...) = 52 The fields are reserved and therefore not currently used. But as they are, they leak kernel memory, and the fact they are not just zero complicates repurposing of the fields for new ends. Initialize the full structure.
CVE-2024-46824
In the Linux kernel, the following vulnerability has been resolved: iommufd: Require drivers to supply the cache_invalidate_user ops If drivers don't do this then iommufd will oops invalidation ioctls with something like: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 Mem abort info: ESR = 0x0000000086000004 EC = 0x21: IABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x04: level 0 translation fault user pgtable: 4k pages, 48-bit VAs, pgdp=0000000101059000 [0000000000000000] pgd=0000000000000000, p4d=0000000000000000 Internal error: Oops: 0000000086000004 [#1] PREEMPT SMP Modules linked in: CPU: 2 PID: 371 Comm: qemu-system-aar Not tainted 6.8.0-rc7-gde77230ac23a #9 Hardware name: linux,dummy-virt (DT) pstate: 81400809 (Nzcv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=-c) pc : 0x0 lr : iommufd_hwpt_invalidate+0xa4/0x204 sp : ffff800080f3bcc0 x29: ffff800080f3bcf0 x28: ffff0000c369b300 x27: 0000000000000000 x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000 x23: 0000000000000000 x22: 00000000c1e334a0 x21: ffff0000c1e334a0 x20: ffff800080f3bd38 x19: ffff800080f3bd58 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 0000ffff8240d6d8 x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000 x8 : 0000001000000002 x7 : 0000fffeac1ec950 x6 : 0000000000000000 x5 : ffff800080f3bd78 x4 : 0000000000000003 x3 : 0000000000000002 x2 : 0000000000000000 x1 : ffff800080f3bcc8 x0 : ffff0000c6034d80 Call trace: 0x0 iommufd_fops_ioctl+0x154/0x274 __arm64_sys_ioctl+0xac/0xf0 invoke_syscall+0x48/0x110 el0_svc_common.constprop.0+0x40/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x34/0xb4 el0t_64_sync_handler+0x120/0x12c el0t_64_sync+0x190/0x194 All existing drivers implement this op for nesting, this is mostly a bisection aid.
In the Linux kernel, the following vulnerability has been resolved: iommufd: Require drivers to supply the cache_invalidate_user ops If drivers don't do this then iommufd will oops invalidation ioctls with something like: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 Mem abort info: ESR = 0x0000000086000004 EC = 0x21: IABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x04: level 0 translation fault user pgtable: 4k pages, 48-bit VAs, pgdp=0000000101059000 [0000000000000000] pgd=0000000000000000, p4d=0000000000000000 Internal error: Oops: 0000000086000004 [#1] PREEMPT SMP Modules linked in: CPU: 2 PID: 371 Comm: qemu-system-aar Not tainted 6.8.0-rc7-gde77230ac23a #9 Hardware name: linux,dummy-virt (DT) pstate: 81400809 (Nzcv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=-c) pc : 0x0 lr : iommufd_hwpt_invalidate+0xa4/0x204 sp : ffff800080f3bcc0 x29: ffff800080f3bcf0 x28: ffff0000c369b300 x27: 0000000000000000 x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000 x23: 0000000000000000 x22: 00000000c1e334a0 x21: ffff0000c1e334a0 x20: ffff800080f3bd38 x19: ffff800080f3bd58 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 0000ffff8240d6d8 x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000 x8 : 0000001000000002 x7 : 0000fffeac1ec950 x6 : 0000000000000000 x5 : ffff800080f3bd78 x4 : 0000000000000003 x3 : 0000000000000002 x2 : 0000000000000000 x1 : ffff800080f3bcc8 x0 : ffff0000c6034d80 Call trace: 0x0 iommufd_fops_ioctl+0x154/0x274 __arm64_sys_ioctl+0xac/0xf0 invoke_syscall+0x48/0x110 el0_svc_common.constprop.0+0x40/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x34/0xb4 el0t_64_sync_handler+0x120/0x12c el0t_64_sync+0x190/0x194 All existing drivers implement this op for nesting, this is mostly a bisection aid.
CVE-2024-46858
In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: Fix uaf in __timer_delete_sync There are two paths to access mptcp_pm_del_add_timer, result in a race condition: CPU1 CPU2 ==== ==== net_rx_action napi_poll netlink_sendmsg __napi_poll netlink_unicast process_backlog netlink_unicast_kernel __netif_receive_skb genl_rcv __netif_receive_skb_one_core netlink_rcv_skb NF_HOOK genl_rcv_msg ip_local_deliver_finish genl_family_rcv_msg ip_protocol_deliver_rcu genl_family_rcv_msg_doit tcp_v4_rcv mptcp_pm_nl_flush_addrs_doit tcp_v4_do_rcv mptcp_nl_remove_addrs_list tcp_rcv_established mptcp_pm_remove_addrs_and_subflows tcp_data_queue remove_anno_list_by_saddr mptcp_incoming_options mptcp_pm_del_add_timer mptcp_pm_del_add_timer kfree(entry) In remove_anno_list_by_saddr(running on CPU2), after leaving the critical zone protected by "pm.lock", the entry will be released, which leads to the occurrence of uaf in the mptcp_pm_del_add_timer(running on CPU1). Keeping a reference to add_timer inside the lock, and calling sk_stop_timer_sync() with this reference, instead of "entry->add_timer". Move list_del(&entry->list) to mptcp_pm_del_add_timer and inside the pm lock, do not directly access any members of the entry outside the pm lock, which can avoid similar "entry->x" uaf.
In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: Fix uaf in __timer_delete_sync There are two paths to access mptcp_pm_del_add_timer, result in a race condition: CPU1 CPU2 ==== ==== net_rx_action napi_poll netlink_sendmsg __napi_poll netlink_unicast process_backlog netlink_unicast_kernel __netif_receive_skb genl_rcv __netif_receive_skb_one_core netlink_rcv_skb NF_HOOK genl_rcv_msg ip_local_deliver_finish genl_family_rcv_msg ip_protocol_deliver_rcu genl_family_rcv_msg_doit tcp_v4_rcv mptcp_pm_nl_flush_addrs_doit tcp_v4_do_rcv mptcp_nl_remove_addrs_list tcp_rcv_established mptcp_pm_remove_addrs_and_subflows tcp_data_queue remove_anno_list_by_saddr mptcp_incoming_options mptcp_pm_del_add_timer mptcp_pm_del_add_timer kfree(entry) In remove_anno_list_by_saddr(running on CPU2), after leaving the critical zone protected by "pm.lock", the entry will be released, which leads to the occurrence of uaf in the mptcp_pm_del_add_timer(running on CPU1). Keeping a reference to add_timer inside the lock, and calling sk_stop_timer_sync() with this reference, instead of "entry->add_timer". Move list_del(&entry->list) to mptcp_pm_del_add_timer and inside the pm lock, do not directly access any members of the entry outside the pm lock, which can avoid similar "entry->x" uaf.
追加情報:
N/A
ダウンロード:
SRPMS
- kernel-5.14.0-503.14.1.el9_5.src.rpm
MD5: 37edc82c32c3b8e1e0c446827f2f1b78
SHA-256: 6b0bb55b095021fd396227a6b591b0436e30c34857dfbd610d89d7c0dacbdadb
Size: 141.79 MB
Asianux Server 9 for x86_64
- bpftool-7.4.0-503.14.1.el9_5.x86_64.rpm
MD5: ab6f0e22e6975d1c2c1f729c1d19d68e
SHA-256: db38651ff927f17ea6c781b2a9a16d3e3c8b28ed3eb98e6509317d5d9670220c
Size: 2.78 MB - kernel-5.14.0-503.14.1.el9_5.x86_64.rpm
MD5: d4904b131eb1550e4fcc4f70e85b51b7
SHA-256: 9e34332b90437a29d4ce13ea163c7552af29880e7299392563ea7196a29e0fa2
Size: 2.01 MB - kernel-abi-stablelists-5.14.0-503.14.1.el9_5.noarch.rpm
MD5: 5412b6a958261dd19b28b25fee476ab2
SHA-256: ad4e95cf376255f45a233d5d10bb42cee711b8841bd2b5a981d96e6fcd31a162
Size: 2.03 MB - kernel-core-5.14.0-503.14.1.el9_5.x86_64.rpm
MD5: ca4aca1e27344e2474c5c0559b818a4d
SHA-256: 0f14eed7dbfda8420b6d1fd8c32f13aad5f93a6a06ccd3c81920b08f4f0d62de
Size: 17.62 MB - kernel-cross-headers-5.14.0-503.14.1.el9_5.x86_64.rpm
MD5: c7041fa16ab97c3e1df23401a33eb80f
SHA-256: 184240390dd1e1a5b383c39cbd350cb5dc63519f131cda1ea6ce1f3e23b38609
Size: 8.76 MB - kernel-debug-5.14.0-503.14.1.el9_5.x86_64.rpm
MD5: 72d9848e3bab273886b2ee11bd00f55d
SHA-256: 76df305c3b66444290a9bd0c7d59ede77a895a62821fc201d04b50042eda8eec
Size: 2.01 MB - kernel-debug-core-5.14.0-503.14.1.el9_5.x86_64.rpm
MD5: 8a57b7205171e31c0aefd429f2c6569e
SHA-256: 18becc44e442cb5123c1e162fbbee104787397be6c479c78c4fcbfc922bcbe75
Size: 30.69 MB - kernel-debug-devel-5.14.0-503.14.1.el9_5.x86_64.rpm
MD5: 047fc45e1dfbf7c66e1dd9d1ba673f78
SHA-256: 74d4351dea7ac92fc4e6c26bdcd7fbf7f508310983d7f820aa78e99e3bb03c76
Size: 21.73 MB - kernel-debug-devel-matched-5.14.0-503.14.1.el9_5.x86_64.rpm
MD5: de33391d5f8f3e8d4195e1e150a61505
SHA-256: 68cf13c8008dd31a2743a3dc33fca230fc7fb82a94e6342b784b17b7f1d11b5a
Size: 2.01 MB - kernel-debug-modules-5.14.0-503.14.1.el9_5.x86_64.rpm
MD5: a90b1433211cfe7b1f5a3fe329aca0c1
SHA-256: d0cd405762ad38955eb41def5cb7161336dcef82aa93d20fa02e2f0578200e89
Size: 62.63 MB - kernel-debug-modules-core-5.14.0-503.14.1.el9_5.x86_64.rpm
MD5: a555c6eec5ff6efd5334eedc4d4654fb
SHA-256: 81fc5a87507c5f01c1570a610a47f810bef7d9597d33eaf8400c4513b5de76cf
Size: 47.95 MB - kernel-debug-modules-extra-5.14.0-503.14.1.el9_5.x86_64.rpm
MD5: 68dd3f94c247a262bc09643f6fe44d6d
SHA-256: b360c330710b706d278379a0e0f76f70fc571651db159ecd503df422774ecf2c
Size: 2.87 MB - kernel-debug-uki-virt-5.14.0-503.14.1.el9_5.x86_64.rpm
MD5: 0c8aeff8cb19759b96ec83dd3aebd54d
SHA-256: 95817378d00442067438f2e0c46d8744b5a41c03244cdf18f04098fc8afac145
Size: 81.28 MB - kernel-devel-5.14.0-503.14.1.el9_5.x86_64.rpm
MD5: 2c131c76e3212e19a8824ae7a6c52b11
SHA-256: ece6f5beaee08341d5ede1a4c6d3512d6378838195d1bbe59e470247b4a96a76
Size: 21.54 MB - kernel-devel-matched-5.14.0-503.14.1.el9_5.x86_64.rpm
MD5: cafe1c915feecbebc29e97cf7d027993
SHA-256: 918a507cb8c9fc317ce7ac80bc26a5daf42696df08b9d668c33d47efe7769cee
Size: 2.01 MB - kernel-doc-5.14.0-503.14.1.el9_5.noarch.rpm
MD5: f465310d6a78eb631e4f08948ec4038f
SHA-256: d3572dd16c5f7523a86db5971823befaa8d8085ce00a6db0b8a4d906a2789827
Size: 37.40 MB - kernel-headers-5.14.0-503.14.1.el9_5.x86_64.rpm
MD5: 227b2bbdc8820ea1e7d9b2b0f09bcd2b
SHA-256: fe763d1b8733ef023fc92cdb20915e8fef78ceb8b6e50809928736964a04027c
Size: 3.72 MB - kernel-modules-5.14.0-503.14.1.el9_5.x86_64.rpm
MD5: 967e09f7d71f200c9506a52f6bb824fc
SHA-256: c62af0372e7106d3c80903fdafeee2b088cc90a5f479b408893a14a15dea2197
Size: 36.52 MB - kernel-modules-core-5.14.0-503.14.1.el9_5.x86_64.rpm
MD5: 5a605ea70fbeb35f6310feadadf6c1ec
SHA-256: 64db98f67fd0a95ccb57bba0815c295323c0ac6390ba4b063cd8ba48dd44cbc6
Size: 30.41 MB - kernel-modules-extra-5.14.0-503.14.1.el9_5.x86_64.rpm
MD5: b469be9cc9022bfa7f7f6ab91d95e652
SHA-256: 0bc0a70c7a1c8e61ab1aa79e5a3a0d3b553869bdcb2cabcb85da21af06342268
Size: 2.48 MB - kernel-tools-5.14.0-503.14.1.el9_5.x86_64.rpm
MD5: 46cf2573aae9b080caac3de82e086ab4
SHA-256: 88c7d451c062985d07d33f1d28424d7de77353c7790b6a19fd85efa8bbca4026
Size: 2.27 MB - kernel-tools-libs-5.14.0-503.14.1.el9_5.x86_64.rpm
MD5: 35f11efd57917e4b0c1144635d8b2ffa
SHA-256: bce858364ae4a2cb199c038c59705fe691f3ebedba9675e306df90f4f3ee0401
Size: 2.02 MB - kernel-tools-libs-devel-5.14.0-503.14.1.el9_5.x86_64.rpm
MD5: f79da8aed8934c32c6c18938d534cbf2
SHA-256: 7759dfb78353e0fbf7259dc9696bdb96c5f9536387426123bd359d2d1b2be4be
Size: 2.01 MB - kernel-uki-virt-5.14.0-503.14.1.el9_5.x86_64.rpm
MD5: 64ecd3a20e033b7f570c887e2b3cb104
SHA-256: 4a25d5580739de52dcb82ed1136b059ffa27d7b1fc49f4c10da6bb2f4a076ee1
Size: 60.46 MB - kernel-uki-virt-addons-5.14.0-503.14.1.el9_5.x86_64.rpm
MD5: a2757505b0de4611a43155895b13ea21
SHA-256: 278806928e114f0bed9062ba0f0c121cdb109fb75c7edda86555139a471e1751
Size: 2.03 MB - libperf-5.14.0-503.14.1.el9_5.x86_64.rpm
MD5: 6e76f019839282e4eb0052d33f8016df
SHA-256: 054bf9fffbeb04ec356e44c4b67494d67679b6b23612f292e4a96ffa85dc1527
Size: 2.03 MB - perf-5.14.0-503.14.1.el9_5.x86_64.rpm
MD5: ec6c79b73a639fa36ec301155db960b8
SHA-256: 770a4c12a651f9e63da7442838b2696226bdc23177f302e29a87af9d82e35edf
Size: 4.19 MB - python3-perf-5.14.0-503.14.1.el9_5.x86_64.rpm
MD5: 38d15de8a79d1eff5628b4c2c60ef53b
SHA-256: 720960471cf176385c3f9571d56f4578a19b37ebde541817f6cf44103fc6d000
Size: 2.11 MB - rtla-5.14.0-503.14.1.el9_5.x86_64.rpm
MD5: f87570ba5cf3cd70a08b23f2e535e9ce
SHA-256: 3caed16a6de4cc273b140bede8c2ae48343921d316d8d3c3461baf5ea49eb7c3
Size: 2.06 MB - rv-5.14.0-503.14.1.el9_5.x86_64.rpm
MD5: c88a0b1567afb45821d99f2af4158f3b
SHA-256: 4b32bfd3a49c556c0d22bd8016722314537aff2197b8b765bdb491ee1b9cd6c6
Size: 2.02 MB
English