CentOS 9：kernel-5.14.0-437.el9
low Nessus 插件 ID 193925
语言：
简介
远程 CentOS 主机缺少一个或多个 bpftool 安全更新。描述
远程 CentOS Linux 9 主机上安装的多个程序包受到 kernel-5.14.0-437.el9 版本变更日志中提及的多个漏洞影响。- 在 Linux 内核中，以下漏洞已修复：mm/sparsemem：修复访问 memory_section->usage 时发生的争用 在设备内存区域内的 PFN 上发现下方的争用，其中 PFN 的系统内存配置为 [ZONE_NORMAL ZONE_DEVICE ZONE_NORMAL]。由于正常的区域开始和结束 pfn 也包含设备内存 PFN，因此即使在 NOP 中结束，也会在设备内存 PFN 上尝试触发的压缩（因为 pfn_to_online_page() 会为 ZONE_DEVICE 内存部分返回空）。当从其他核心删除 ZONE_DEVICE 区域（含有相关的 PFN）的区段映射时，当前正在其中执行的压缩操作会导致已启用 CONFIG_SPASEMEM_VMEMAP 的内核崩溃。请参查看 [1] 中的崩溃日志。
compact_zone() memunmap_pages ------------- --------------- __pageblock_pfn_to_page ...... (a)pfn_valid():
valid_section()//return true (b)__remove_pages()-> sparse_remove_section()-> section_deactivate()：[释放数组 ms->usage 并设置 ms->usage = NULL] pfn_section_valid() [访问状态为 NULL 的 ms->usage] 注意：
从上文可以看到，启用 SPASEMEM_VMEMAP 时，pfn_valid()/pfn_section_valid() 与区段停用之间才会发生争用。提交 b943f045a9af（mm/sparse：通过 pfn_section_valid 检查解决内存崩溃）尝试通过清除 SECTION_HAS_MEM_MAP 来解决相同的问题，并期望 valid_section() 返回 false，这样 ms->usage 就不会被访问。通过以下步骤解决此问题：a) 释放 ->usage 之前清除 SECTION_HAS_MEM_MAP。b) SECTION_HAS_MEM_MAP 被清除后，受 RCU 保护的读取端关键部分将返回 NULL 或可以成功访问 ->usage。c) 使用 kfree_rcu() 释放 ->usage 并设置 ms->usage = NULL。之后，系统不会尝试访问 ->usage，因为 SECTION_HAS_MEM_MAP 已清除，所以 valid_section() 会返回 false。感谢 David/Pavan 提供有关此补丁的建议。[1] https://lore.kernel.org/linux-mm/994410bb-89aa-d987-1f50-f514903c55aa@quicinc.com/ 在 Snapdragon SoC 上，由于上述 PFN 的内存配置为 [ZONE_NORMAL ZONE_DEVICE ZONE_NORMAL]，我们在 Device Farm 中进行测试时，每天都可能会发现大量问题。以下是有关此特定问题的日志。尽管以下日志未直接指向 pfn_section_valid(){ ms->usage;}，当我们在 T32 lauterbach 工具上加载此转储时，却指向的该对象。[ 540.578056] 无法处理虚拟地址 0000000000000000 上的内核空指针取消引用 [ 540.578068] 内存中止信息[ 540.578070] ESR = 0x0000000096000005 [ 540.578073] EC = 0x25：DABT（当前 EL），IL = 32 位 [ 540.578077] SET = 0，FnV = 0 [ 540.578080] EA = 0，S1PTW = 0 [540.578082] FSC = 0x05：1 级转换错误 [ 540.578085] 数据中止信息：[ 540.578086] ISV = 0，ISS = 0x00000005 [ 540.578088] CM = 0，WnR = 0 [ 540.579431] 粘贴：82400005 (Nzcv daif +PAN -UAO +TCO
-DIT -SSBSBTYPE=--) [ 540.579436] pc：__pageblock_pfn_to_page+0x6c/0x14c [ 540.579454] lr：
compact_zone+0x994/0x1058 [ 540.579460] sp：ffffffc03579b510 [ 540.579463] x29：ffffffc03579b510 x28：
0000000000235800 x27：000000000000000c [ 540.579470] x26：0000000000235c00 x25：0000000000000068 x24：ffffffc03579b640 [ 540.579477] x23：0000000000000001 x22：ffffffc03579b660 x21：0000000000000000 [540.579483] x20：0000000000235bff x19：ffffffdebf7e3940 x18：ffffffdebf66d140 [ 540.579489] x17：
00000000739ba063 x16：00000000739ba063 x15：00000000009f4bff [ 540.579495] x14：0000008000000000 x13：
0000000000000000 x12：0000000000000001 [ 540.579501] x11：0000000000000000 x10：0000000000000000 x9：ffffff897d2cd440 [ 540.579507] x8：0000000000000000 x7：0000000000000000 x6：ffffffc03579b5b4 [540.579512] x5：0000000000027f25 x4：ffffffc03579b5b8 x3：0000000000000 ---truncated--- (CVE-2023-52489)
- 在 Linux 内核中，以下漏洞已修复：net：usb：smsc75xx：修复 __smsc75xx_read_reg 中的 uninit-value 访问 syzbot 报告了以下 uninit-value 访问问题：
===================================================== 错误：KMSAN：smsc75xx_wait_ready drivers/net/usb/smsc75xx.c:975 中的 uninit-value [inline] 错误：KMSAN：smsc75xx_bind+0x5c9/0x11e0 drivers/net/usb/smsc75xx.c:1482 中的 uninit-value CPU：0 PID：8696 命令：kworker/0:3 未感染 5.8.0-rc5-syzkaller #0 硬件名称：Google Google Compute Engine/Google Compute Engine，BIOS Google 01/01/2011 工作队列：
usb_hub_wq hub_event 调用跟踪：__dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x21c/0x280 lib/dump_stack.c:118 kmsan_report+0xf7/0x1e0 mm/kmsan/kmsan_report.c:121 __msan_warning+0x58/0xa0 mm/kmsan/kmsan_instr.c:215 smsc75xx_wait_ready drivers/net/usb/smsc75xx.c:975 [inline] smsc75xx_bind+0x5c9/0x11e0 drivers/net/usb/smsc75xx.c:1482 usbnet_probe+0x1152/0x3f90 drivers/net/usb/usbnet.c:1737 usb_probe_interface+0xece/0x1550 drivers/usb/core/driver.c:374 really_probe+0xf20/0x20b0 drivers/base/dd.c:529 driver_probe_device+0x293/0x390 drivers/base/dd.c:701
__device_attach_driver+0x63f/0x830 drivers/base/dd.c:807 bus_for_each_drv+0x2ca/0x3f0 drivers/base/bus.c:431 __device_attach+0x4e2/0x7f0 drivers/base/dd.c:873 device_initial_probe+0x4a/0x60 drivers/base/dd.c:920 bus_probe_device+0x177/0x3d0 drivers/base/bus.c:491 device_add+0x3b0e/0x40d0 drivers/base/core.c:2680 usb_set_configuration+0x380f/0x3f10 drivers/usb/core/message.c:2032 usb_generic_driver_probe+0x138/0x300 drivers/usb/core/generic.c:241 usb_probe_device+0x311/0x490 drivers/usb/core/driver.c:272 really_probe+0xf20/0x20b0 drivers/base/dd.c:529 driver_probe_device+0x293/0x390 drivers/base/dd.c:701 __device_attach_driver+0x63f/0x830 drivers/base/dd.c:807 bus_for_each_drv+0x2ca/0x3f0 drivers/base/bus.c:431 __device_attach+0x4e2/0x7f0 drivers/base/dd.c:873 device_initial_probe+0x4a/0x60 drivers/base/dd.c:920 bus_probe_device+0x177/0x3d0 drivers/base/bus.c:491 device_add+0x3b0e/0x40d0 drivers/base/core.c:2680 usb_new_device+0x1bd4/0x2a30 drivers/usb/core/hub.c:2554 hub_port_connect drivers/usb/core/hub.c:5208 [inline] hub_port_connect_change drivers/usb/core/hub.c:5348 [inline] port_event drivers/usb/core/hub.c:5494 [inline] hub_event+0x5e7b/0x8a70 drivers/usb/core/hub.c:5576 process_one_work+0x1688/0x2140 kernel/workqueue.c:2269 worker_thread+0x10bc/0x2730 kernel/workqueue.c:2415 kthread+0x551/0x590 kernel/kthread.c:292 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:293 Local variable ----buf.i87@smsc75xx_bind 创建位置：
__smsc75xx_read_reg drivers/net/usb/smsc75xx.c:83 [inline] smsc75xx_wait_ready drivers/net/usb/smsc75xx.c:968 [inline] smsc75xx_bind+0x485/0x11e0 drivers/net/usb/smsc75xx.c:1482
__smsc75xx_read_reg drivers/net/usb/smsc75xx.c:83 [inline] smsc75xx_wait_ready drivers/net/usb/smsc75xx.c:968 [inline] smsc75xx_bind+0x485/0x11e0 drivers/net/usb/smsc75xx.c:1482 之所以出现此问题，是因为 usbnet_read_cmd() 读取的字节少于请求的字节（复制程序中为零字节）。
在这种情况下，“buf”未正确填充。如果 usbnet_read_cmd() 读取的字节少于请求的字节，此补丁会返回 -ENODATA，进而解决此问题。(CVE-2023-52528)
请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。
解决方案
更新 CentOS 9 Stream bpftool 程序包。另见
https://kojihub.stream.centos.org/koji/buildinfo?buildID=60487
插件详情
严重性: Low
ID: 193925
文件名: centos9_kernel-5_14_0-437_60487.nasl
版本: 1.0
类型: local
代理: unix
发布时间: 2024/4/26
最近更新时间: 2024/4/26
支持的传感器: Agentless Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus
风险信息
VPR
风险因素: Medium
分数: 4.4
CVSS v2
风险因素: Low
基本分数: 3.6
时间分数: 2.7
矢量: CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:P
CVSS 分数来源: CVE-2023-52528
CVSS v3
风险因素: Low
基本分数: 3.5
时间分数: 3.1
矢量: CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
时间矢量: CVSS:3.0/E:U/RL:O/RC:C
漏洞信息
CPE: cpe:/a:centos:centos:9, p-cpe:/a:centos:centos:bpftool, p-cpe:/a:centos:centos:kernel, p-cpe:/a:centos:centos:kernel-64k, p-cpe:/a:centos:centos:kernel-64k-core, p-cpe:/a:centos:centos:kernel-64k-debug, p-cpe:/a:centos:centos:kernel-64k-debug-core, p-cpe:/a:centos:centos:kernel-64k-debug-devel, p-cpe:/a:centos:centos:kernel-64k-debug-devel-matched, p-cpe:/a:centos:centos:kernel-64k-debug-modules, p-cpe:/a:centos:centos:kernel-64k-debug-modules-core, p-cpe:/a:centos:centos:kernel-64k-debug-modules-extra, p-cpe:/a:centos:centos:kernel-64k-debug-modules-internal, p-cpe:/a:centos:centos:kernel-64k-debug-modules-partner, p-cpe:/a:centos:centos:kernel-64k-devel, p-cpe:/a:centos:centos:kernel-64k-devel-matched, p-cpe:/a:centos:centos:kernel-64k-modules, p-cpe:/a:centos:centos:kernel-64k-modules-core, p-cpe:/a:centos:centos:kernel-64k-modules-extra, p-cpe:/a:centos:centos:kernel-64k-modules-internal, p-cpe:/a:centos:centos:kernel-64k-modules-partner, p-cpe:/a:centos:centos:kernel-abi-stablelists, p-cpe:/a:centos:centos:kernel-core, p-cpe:/a:centos:centos:kernel-rt-debug-core, p-cpe:/a:centos:centos:kernel-rt-debug-devel, p-cpe:/a:centos:centos:kernel-rt-debug-devel-matched, p-cpe:/a:centos:centos:kernel-rt-debug-kvm, p-cpe:/a:centos:centos:kernel-rt-debug-modules, p-cpe:/a:centos:centos:kernel-rt-debug-modules-core, p-cpe:/a:centos:centos:kernel-rt-debug-modules-extra, p-cpe:/a:centos:centos:kernel-rt-debug-modules-internal, p-cpe:/a:centos:centos:kernel-rt-debug-modules-partner, p-cpe:/a:centos:centos:kernel-rt-devel, p-cpe:/a:centos:centos:kernel-rt-devel-matched, p-cpe:/a:centos:centos:kernel-rt-kvm, p-cpe:/a:centos:centos:kernel-rt-modules, p-cpe:/a:centos:centos:kernel-rt-modules-core, p-cpe:/a:centos:centos:kernel-rt-modules-extra, p-cpe:/a:centos:centos:kernel-rt-modules-internal, p-cpe:/a:centos:centos:kernel-rt-modules-partner, p-cpe:/a:centos:centos:kernel-selftests-internal, p-cpe:/a:centos:centos:kernel-tools, p-cpe:/a:centos:centos:kernel-tools-libs, p-cpe:/a:centos:centos:kernel-tools-libs-devel, p-cpe:/a:centos:centos:kernel-uki-virt, p-cpe:/a:centos:centos:kernel-zfcpdump, p-cpe:/a:centos:centos:kernel-zfcpdump-core, p-cpe:/a:centos:centos:kernel-zfcpdump-devel, p-cpe:/a:centos:centos:kernel-zfcpdump-devel-matched, p-cpe:/a:centos:centos:kernel-zfcpdump-modules, p-cpe:/a:centos:centos:kernel-zfcpdump-modules-core, p-cpe:/a:centos:centos:kernel-zfcpdump-modules-extra, p-cpe:/a:centos:centos:kernel-zfcpdump-modules-internal, p-cpe:/a:centos:centos:kernel-zfcpdump-modules-partner, p-cpe:/a:centos:centos:libperf, p-cpe:/a:centos:centos:libperf-devel, p-cpe:/a:centos:centos:kernel-cross-headers, p-cpe:/a:centos:centos:kernel-debug, p-cpe:/a:centos:centos:kernel-debug-core, p-cpe:/a:centos:centos:kernel-debug-devel, p-cpe:/a:centos:centos:kernel-debug-devel-matched, p-cpe:/a:centos:centos:kernel-debug-modules, p-cpe:/a:centos:centos:kernel-debug-modules-core, p-cpe:/a:centos:centos:kernel-debug-modules-extra, p-cpe:/a:centos:centos:kernel-debug-modules-internal, p-cpe:/a:centos:centos:kernel-debug-modules-partner, p-cpe:/a:centos:centos:kernel-debug-uki-virt, p-cpe:/a:centos:centos:kernel-devel, p-cpe:/a:centos:centos:kernel-devel-matched, p-cpe:/a:centos:centos:kernel-headers, p-cpe:/a:centos:centos:kernel-ipaclones-internal, p-cpe:/a:centos:centos:kernel-modules, p-cpe:/a:centos:centos:kernel-modules-core, p-cpe:/a:centos:centos:kernel-modules-extra, p-cpe:/a:centos:centos:kernel-modules-internal, p-cpe:/a:centos:centos:kernel-modules-partner, p-cpe:/a:centos:centos:kernel-rt, p-cpe:/a:centos:centos:kernel-rt-core, p-cpe:/a:centos:centos:kernel-rt-debug, p-cpe:/a:centos:centos:perf, p-cpe:/a:centos:centos:python3-perf, p-cpe:/a:centos:centos:rtla, p-cpe:/a:centos:centos:rv
必需的 KB 项: Host/local_checks_enabled, Host/CentOS/release, Host/CentOS/rpm-list, Host/cpu
易利用性: No known exploits are available
补丁发布日期: 2024/4/9
漏洞发布日期: 2024/3/2
参考资料信息
CVE: CVE-2023-52489, CVE-2023-52528