CVE-2023-52886— Linux kernel 安全漏洞
一分钟漏洞结论
影响对象
Linux Linux
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel 存在安全漏洞，该漏洞源于USB模块中发现竞争条件问题。hub_port_init函数在初始化时可能会覆盖udev->descriptor，导致数据竞争。
影响版本矩阵 25
| 厂商 | 产品 | 版本范围 | 状态 |
|---|---|---|---|
| Linux | Linux | 218925bfd5d1436e337c4f961e9c149fbe32de6d< 9d241c5d9a9b7ad95c90c6520272fe404d5ac88f |
affected |
77358093331e9769855140bf94a3f00ecdcf4bb1< 7fe9d87996062f5eb0ca476ad0257f79bf43aaf5 |
affected | ||
c87fb861ec185fdc578b4fdc6a05920b6a843840< 8186596a663506b1124bede9fde6f243ef9f37ee |
affected | ||
45bf39f8df7f05efb83b302c65ae3b9bc92b7065< b4a074b1fb222164ed7d5c0b8c922dc4a0840848 |
affected | ||
45bf39f8df7f05efb83b302c65ae3b9bc92b7065< b9fbfb349eacc0820f91c797d7f0a3ac7a4935b5 |
affected | ||
45bf39f8df7f05efb83b302c65ae3b9bc92b7065< ff33299ec8bb80cdcc073ad9c506bd79bb2ed20b |
affected | ||
6badaf880edf51a2da7a439699676394dfdef3e5 |
affected | ||
5f35b5d3bd6914c68f743741443dfd3a64b0e455 |
affected | ||
| … +17 条更多 | |||
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2023-52886 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
USB: core: Fix race by not overwriting udev->descriptor in hub_port_init()
来源: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
USB: core: Fix race by not overwriting udev->descriptor in hub_port_init()
Syzbot reported an out-of-bounds read in sysfs.c:read_descriptors():
BUG: KASAN: slab-out-of-bounds in read_descriptors+0x263/0x280 drivers/usb/core/sysfs.c:883
Read of size 8 at addr ffff88801e78b8c8 by task udevd/5011
CPU: 0 PID: 5011 Comm: udevd Not tainted 6.4.0-rc6-syzkaller-00195-g40f71e7cd3c6 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xd9/0x150 lib/dump_stack.c:106
print_address_description.constprop.0+0x2c/0x3c0 mm/kasan/report.c:351
print_report mm/kasan/report.c:462 [inline]
kasan_report+0x11c/0x130 mm/kasan/report.c:572
read_descriptors+0x263/0x280 drivers/usb/core/sysfs.c:883
...
Allocated by task 758:
...
__do_kmalloc_node mm/slab_common.c:966 [inline]
__kmalloc+0x5e/0x190 mm/slab_common.c:979
kmalloc include/linux/slab.h:563 [inline]
kzalloc include/linux/slab.h:680 [inline]
usb_get_configuration+0x1f7/0x5170 drivers/usb/core/config.c:887
usb_enumerate_device drivers/usb/core/hub.c:2407 [inline]
usb_new_device+0x12b0/0x19d0 drivers/usb/core/hub.c:2545
As analyzed by Khazhy Kumykov, the cause of this bug is a race between
read_descriptors() and hub_port_init(): The first routine uses a field
in udev->descriptor, not expecting it to change, while the second
overwrites it.
Prior to commit 45bf39f8df7f ("USB: core: Don't hold device lock while
reading the "descriptors" sysfs file") this race couldn't occur,
because the routines were mutually exclusive thanks to the device
locking. Removing that locking from read_descriptors() exposed it to
the race.
The best way to fix the bug is to keep hub_port_init() from changing
udev->descriptor once udev has been initialized and registered.
Drivers expect the descriptors stored in the kernel to be immutable;
we should not undermine this expectation. In fact, this change should
have been made long ago.
So now hub_port_init() will take an additional argument, specifying a
buffer in which to store the device descriptor it reads. (If udev has
not yet been initialized, the buffer pointer will be NULL and then
hub_port_init() will store the device descriptor in udev as before.)
This eliminates the data race responsible for the out-of-bounds read.
The changes to hub_port_init() appear more extensive than they really
are, because of indentation changes resulting from an attempt to avoid
writing to other parts of the usb_device structure after it has been
initialized. Similar changes should be made to the code that reads
the BOS descriptor, but that can be handled in a separate patch later
on. This patch is sufficient to fix the bug found by syzbot.
来源: CVE Program / CVE List V5
CVSS Information
N/A
来源: CVE Program / CVE List V5
Vulnerability Type
N/A
来源: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel 存在安全漏洞，该漏洞源于USB模块中发现竞争条件问题。hub_port_init函数在初始化时可能会覆盖udev->descriptor，导致数据竞争。
来源: 中国国家信息安全漏洞库 CNNVD
CVSS Information
N/A
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Type
N/A
来源: 中国国家信息安全漏洞库 CNNVD
受影响产品
二、漏洞 CVE-2023-52886 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2023-52886 的情报信息
请登录查看更多情报信息。
CVE-2023-52886 其他参考 (6)
同批安全公告 · Linux · 2024-07-16 · 共 98 条
| CVE-2022-48851 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2022-48788 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2022-48789 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2022-48790 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2022-48829 | 9.1 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2022-48828 | 9.1 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2022-48782 | 8.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2022-48785 | 8.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2022-48830 | 8.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2022-48864 | 8.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2022-48791 | 7.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2022-48792 | 7.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2022-48796 | 7.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2022-48787 | 7.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2022-48786 | 7.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2022-48847 | 7.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2022-48779 | 7.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2022-48821 | 7.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2022-48801 | 7.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2022-48822 | 7.8 HIGH | Linux kernel 安全漏洞 |
显示前 20 条，共 98 条。 查看全部 → →
IV. Related Vulnerabilities
V. Comments for CVE-2023-52886
暂无评论