Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - drm/amdgpu修正釋放後使用錯誤 將單一 amdgpu_gem_userptr_ioctl 傳送至任何位址和大小無效的 ASIC 上的 AMD GPU DRM 驅動程式可觸發該錯誤。此錯誤的報告者為 Joonkyo Jung <joonkyoj@yonsei.ac.kr>。例如下列程式碼static void Syzkaller1(int fd) { struct drm_amdgpu_gem_userptr arg; int ret arg.addr = 0xffffffffffff0000 arg.size = 0x80000000 /*2 Gb*/ arg.flags = 0x7 ret = drmIoctl(fd, 0xc1186451/*amdgpu_gem_userptr_ioctl*/, &arg);由於位址和大小無效在 amdgpu_hmm_register->mmu_interval_notifier_insert->__mmu_interval_notifier_insert-> check_shl_overflow 中會發生失敗但我們即使發生 amdgpu_hmm_register 失敗仍將 amdgpu_hmm_unregister 呼叫至 amdgpu_gem_object_free進而導致存取錯誤的位址。在啟用 Kazan 的情況下重現問題時下列堆疊低於 [ +0.000014] 硬體名稱ASUS 系統產品名稱/ROG STRIX B550-F GAMING (WI-FI), BIOS 1401 12/03/2020 [ +0.000009] RIP0010:mmu_interval_notifier_remove+0x327/0x340 [+0.000017]程式碼ff ff 49 89 44 24 08 48 b8 00 01 00 00 00 ad de 4c 89 f7 49 89 47 40 48 83 c0 22 49 89 47 48 e8 ce d1 2d 01 e9 32 ff ff ff <0f> 0b e9 16 ff ff ff 4c 89 ef e8 fa 14 b3 ff e9 36 ff ff ff e8 80 [+0.000013] RSP0018:ffffc90002657988 EFLAGS00010246 [ +0.000014] RAX0000000000000000 RBX
    1ffff920004caf35 RCXffffffff8160565b [ +0.000011] RDXdffffc0000000000 RSI0000000000000004 RDI
    ffff8881a9f78260 [ +0.000010] RBP: ffffc90002657a70 R08: 0000000000000001 R09: fffff520004caf25 [+0.000010] R10: 0000000000000003 R11: ffffffff8161d1d6 R12: ffff88810e988c00 [ +0.000010] R13:
     R14ffff888126fb5a00  : ffff88810e988c0c R15: ffff8881a9f78260 [ +0.000011] FS: 00007ff9ec848540(0000) GS:ffff8883cc880000(0000) knlGS:0000000000000000 [ +0.000012] CS: 0010 DS: 0000 ES: 0000 CR0:
    0000000080050033 [ +0.000010] CR2000055b3f7e14328 CR300000001b5770000 CR40000000000350ef0 [+0.000010] 呼叫追踪 [ +0.000006] <TASK> [ +0.000007] show_regs+0x6a/0x80 [ +0.000018] ?
    __warn+0xa5/0x1b0 [ +0.000019] ? mmu_interval_notifier_remove+0x327/0x340 [ +0.000018] ? report_bug+0x24a/0x290 [ +0.000022] ? handle_bug+0x46/0x90 [ +0.000015] ? exc_invalid_op+0x19/0x50 [+0.000016] ? asm_exc_invalid_op+0x1b/0x20 [ +0.000017] ? kasan_save_stack+0x26/0x50 [ +0.000017] ? mmu_interval_notifier_remove+0x23b/0x340 [ +0.000019] ? mmu_interval_notifier_remove+0x327/0x340 [+0.000019] mmu_interval_notifier_remove+0x23b/0x340 [ +0.000020] ?
    __pfx_mmu_interval_notifier_remove+0x10/0x10 [ +0.000017] ? kasan_save_alloc_info+0x1e/0x30 [ +0.000018] ? srso_return_thunk+0x5/0x5f [ +0.000014] ? __kasan_kmalloc+0xb1/0xc0 [ +0.000018] ? srso_return_thunk+0x5/0x5f [ +0.000013] ? __kasan_check_read+0x11/0x20 [ +0.000020] amdgpu_hmm_unregister+0x34/0x50 [amdgpu] [ +0.004695] amdgpu_gem_object_free+0x66/0xa0 [amdgpu] [+0.004534] ? __pfx_amdgpu_gem_object_free+0x10/0x10 [amdgpu] [ +0.004291] ? do_syscall_64+0x5f/0xe0 [+0.000023] ? srso_return_thunk+0x5/0x5f [ +0.000017] drm_gem_object_free+0x3b/0x50 [drm] [ +0.000489] amdgpu_gem_userptr_ioctl+0x306/0x500 [amdgpu] [ +0.004295] __pfx_amdgpu_gem_userptr_ioctl+0x10/0x10 [amdgpu] [ +0.004270] srso_return_thunk+0x5/0x5f [ +0.000014] ? __this_cpu_preempt_check+0x13/0x20 [+0.000015] srso_return_thunk+0x5/0x5f [ +0.000013] ? sysvec_apic_timer_interrupt+0x57/0xc0 [ +0.000020] ? srso_return_thunk+0x5/0x5f [ +0.000014] ? asm_sysvec_apic_timer_interrupt+0x1b/0x20 [ +0.000022] ? drm_ioctl_kernel+0x17b/0x1f0 [drm] [ +0.000496] __pfx_amdgpu_gem_userptr_ioctl+0x10/0x10 [amdgpu] [+0.004272] drm_ioctl_kernel+0x190/0x1f0 [drm] [ +0.000492] drm_ioctl_kernel+0x140/0x1f0 [drm] [+0.000497] ? __pfx_amdgpu_gem_userptr_ioctl+0x10/0x10 [amdgpu] [ +0.004297]
    __pfx_drm_ioctl_kernel+0x10/0x10 [d ---truncated--- (CVE-2024-26656)

請注意，Nessus 依賴供應商報告的套件存在。

偵測

Linux Distros 未修補的弱點：CVE-2024-26656

medium Nessus Plugin ID 228213

版本 1.20