CVE-2024-50099— Linux kernel 安全漏洞
一分钟漏洞结论
影响对象
Linux Linux
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于arm64模块在 uprobes 支持中未能正确处理LDR（literal）和LDRSW（literal）指令，可能导致内核崩溃。
可能的 ATT&CK 技术 2 AI
T1027 · Obfuscated Files or Information T1059 · Command and Scripting Interpreter影响版本矩阵 18
| 厂商 | 产品 | 版本范围 | 状态 |
|---|---|---|---|
| Linux | Linux | 9842ceae9fa8deae141533d52a6ead7666962c09< cc86f2e9876c8b5300238cec6bf0bd8c842078ee |
affected |
9842ceae9fa8deae141533d52a6ead7666962c09< ae743deca78d9e4b7f4f60ad2f95e20e8ea057f9 |
affected | ||
9842ceae9fa8deae141533d52a6ead7666962c09< 3728b4eb27910ffedd173018279a970705f2e03a |
affected | ||
9842ceae9fa8deae141533d52a6ead7666962c09< ad4bc35a6d22e9ff9b67d0d0c38bce654232f195 |
affected | ||
9842ceae9fa8deae141533d52a6ead7666962c09< bae792617a7e911477f67a3aff850ad4ddf51572 |
affected | ||
9842ceae9fa8deae141533d52a6ead7666962c09< 9f1e7735474e7457a4d919a517900e46868ae5f6 |
affected | ||
9842ceae9fa8deae141533d52a6ead7666962c09< 20cde998315a3d2df08e26079a3ea7501abce6db |
affected | ||
9842ceae9fa8deae141533d52a6ead7666962c09< acc450aa07099d071b18174c22a1119c57da8227 |
affected | ||
| … +10 条更多 | |||
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2024-50099 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
arm64: probes: Remove broken LDR (literal) uprobe support
来源: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
arm64: probes: Remove broken LDR (literal) uprobe support
The simulate_ldr_literal() and simulate_ldrsw_literal() functions are
unsafe to use for uprobes. Both functions were originally written for
use with kprobes, and access memory with plain C accesses. When uprobes
was added, these were reused unmodified even though they cannot safely
access user memory.
There are three key problems:
1) The plain C accesses do not have corresponding extable entries, and
thus if they encounter a fault the kernel will treat these as
unintentional accesses to user memory, resulting in a BUG() which
will kill the kernel thread, and likely lead to further issues (e.g.
lockup or panic()).
2) The plain C accesses are subject to HW PAN and SW PAN, and so when
either is in use, any attempt to simulate an access to user memory
will fault. Thus neither simulate_ldr_literal() nor
simulate_ldrsw_literal() can do anything useful when simulating a
user instruction on any system with HW PAN or SW PAN.
3) The plain C accesses are privileged, as they run in kernel context,
and in practice can access a small range of kernel virtual addresses.
The instructions they simulate have a range of +/-1MiB, and since the
simulated instructions must itself be a user instructions in the
TTBR0 address range, these can address the final 1MiB of the TTBR1
acddress range by wrapping downwards from an address in the first
1MiB of the TTBR0 address range.
In contemporary kernels the last 8MiB of TTBR1 address range is
reserved, and accesses to this will always fault, meaning this is no
worse than (1).
Historically, it was theoretically possible for the linear map or
vmemmap to spill into the final 8MiB of the TTBR1 address range, but
in practice this is extremely unlikely to occur as this would
require either:
* Having enough physical memory to fill the entire linear map all the
way to the final 1MiB of the TTBR1 address range.
* Getting unlucky with KASLR randomization of the linear map such
that the populated region happens to overlap with the last 1MiB of
the TTBR address range.
... and in either case if we were to spill into the final page there
would be larger problems as the final page would alias with error
pointers.
Practically speaking, (1) and (2) are the big issues. Given there have
been no reports of problems since the broken code was introduced, it
appears that no-one is relying on probing these instructions with
uprobes.
Avoid these issues by not allowing uprobes on LDR (literal) and LDRSW
(literal), limiting the use of simulate_ldr_literal() and
simulate_ldrsw_literal() to kprobes. Attempts to place uprobes on LDR
(literal) and LDRSW (literal) will be rejected as
arm_probe_decode_insn() will return INSN_REJECTED. In future we can
consider introducing working uprobes support for these instructions, but
this will require more significant work.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
来源: CVE Program / CVE List V5
Vulnerability Type
N/A
来源: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于arm64模块在 uprobes 支持中未能正确处理LDR（literal）和LDRSW（literal）指令，可能导致内核崩溃。
来源: 中国国家信息安全漏洞库 CNNVD
CVSS Information
N/A
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Type
N/A
来源: 中国国家信息安全漏洞库 CNNVD
受影响产品
二、漏洞 CVE-2024-50099 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2024-50099 的情报信息
请登录查看更多情报信息。
CVE-2024-50099 补丁与修复 (8)
同批安全公告 · Linux · 2024-11-05 · 共 50 条
| CVE-2024-50106 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2024-50113 | 8.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2024-50115 | 8.4 HIGH | Linux kernel 安全漏洞 |
| CVE-2024-50125 | 8.0 HIGH | Linux kernel 安全漏洞 |
| CVE-2024-50124 | 8.0 HIGH | Linux kernel 安全漏洞 |
| CVE-2024-50132 | 7.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2023-52920 | 7.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2024-50101 | 7.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2024-50091 | 7.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2024-50114 | 7.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2024-50127 | 7.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2024-50126 | 7.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2024-50128 | 7.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2024-50130 | 7.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2024-50090 | 7.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2024-50094 | 7.5 HIGH | Linux kernel 安全漏洞 |
| CVE-2024-50095 | 7.5 HIGH | Linux kernel 安全漏洞 |
| CVE-2024-50117 | 7.3 HIGH | Linux kernel 安全漏洞 |
| CVE-2024-50131 | 7.3 HIGH | Linux kernel 安全漏洞 |
| CVE-2024-50096 | 7.3 HIGH | Linux kernel 安全漏洞 |
显示前 20 条，共 50 条。 查看全部 → →
IV. Related Vulnerabilities
V. Comments for CVE-2024-50099
暂无评论