Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - bonding将 ipsec_lock 从旋转锁更改为互斥 在引用的提交中添加 bond->ipsec_lock 以保护 ipsec_list因此会在该锁内部调用 xdo_dev_state_add 和 xdo_dev_state_delete。由于 ipsec_lock 是旋转锁且此类 xfrmdev ops 可能会休眠因此在更改 bond 的活动从属时将触发 atomic 调度。 [ 101.055189] 缺陷在 atomicbash/902/0x00000200 时进行计划 [101.055726] 链接的模块[ 101.058211] CPU: 3 PID: 902 Comm: bash 未受感染 6.9.0-rc4+ #1 [101.058760] 硬件name[ 101.059434] Call Trace[ 101.059436] <TASK> [ 101.060873] dump_stack_lvl+0x51/0x60 [ 101.061275] __schedule_bug+0x4e/0x60 [ 101.061682] __schedule+0x612/0x7c0 [101.062078] ? __mod_timer+0x25c/0x370 [ 101.062486] schedule+0x25/0xd0 [ 101.062845] schedule_timeout+0x77/0xf0 [ 101.063265] ? asm_common_interrupt+0x22/0x40 [ 101.063724] ?
    __bpf_trace_itimer_state+0x10/0x10 [ 101.064215] __wait_for_common+0x87/0x190 [ 101.064648] ? usleep_range_state+0x90/0x90 [ 101.065091] cmd_exec+0x437/0xb20 [mlx5_core] [ 101.065569] mlx5_cmd_do+0x1e/0x40 [mlx5_core] [ 101.066051] mlx5_cmd_exec+0x18/0x30 [mlx5_core] [ 101.066552] mlx5_crypto_create_dek_key+0x120ea/ [mlx5_core] [ 101.067163] ? bonding_sysfs_store_option+0x4d/0x80 [bonding] [ 101.067738] ? kmalloc_trace+0x4d/0x350 [ 101.068156] mlx5_ipsec_create_sa_ctx+0x33/0x100 [mlx5_core] [ 101.068747] mlx5e_xfrm_add_state+0x47b/0xaa0 [mlx5_core] [ 101.069312] bond_change_active_slave+0x392/0x392/0x3900 [bonding] [ 101.069868] bond_ [bonding] [ 101.070454] __bond_opt_set+0xa6/0x430 [bonding] [ 101.070935] __bond_opt_set_notify+0x2f/0x90 [bonding] [ 101.071453] bond_opt_tryset_rtnl+0x72/0xb0 [bonding] [ 101.071965] bonding_sysfs_store_option+0x4d/0x80 [bonding ] [ 101.072567] kernfs_fop_write_iter+0x10c/0x1a0 [101.073033] vfs_write+0x2d8/0x400 [ 101.073416] ? alloc_fd+0x48/0x180 [ 101.073798] ksys_write+0x5f/0xe0 [101.074175] do_syscall_64+0x52/0x110 [ 101.074576] entry_SYSCALL_64_after_hwframe+0x4b/0x53 由于仅从 bond_change_active_slave 调用 bond_ipsec_add_sa_all 和 bond_ipsec_del_sa_all需要持有 RTlave 锁定。bond_ipsec_add_sa 和 bond_ipsec_del_sa 是 xfrm 状态 xdo_dev_state_add 和 xdo_dev_state_delete API位于用户上下文中。因此 ipsec_lock 不必是 spin lock将其更改为 mutex即可解决上述问题。 (CVE-2024-46678)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

检测

Linux Distros 未修补的漏洞：CVE-2024-46678

medium Nessus 插件 ID 228944

版本 1.25