Alibaba Cloud Linux 2系统的CVE-2021-22555安全漏洞内核热补丁修复方案

问题描述

在符合如下条件的Alibaba Cloud Linux 2实例中，存在CVE-2021-22555安全漏洞，系统运行时出现系统宕机问题，且出现如下调用栈信息。

• 镜像：Alibaba Cloud Linux 2.1903 LTS 64位。

• 内核：kernel-4.19.91-24.al7及之前的内核版本。

[  104.019092] x_tables: ip6_tables: icmp6.0 match: invalid size 8 (kernel) != (user) 212
[  104.020124] BUG: unable to handle kernel paging request at ffff9879000004b8
[  104.020783] PGD 19a01067 P4D 19a01067 PUD 0 
[  104.021177] Oops: 0000 [#1] SMP PTI
[  104.021526] CPU: 0 PID: 94 Comm: kworker/u4:1 Kdump: loaded Tainted: G           O  K   4.19.91-23.al7.x86_64 #1
[  104.022389] Hardware name: Alibaba Cloud Alibaba Cloud ECS, BIOS 8c24b4c 04/01/2014
[  104.023081] Workqueue: netns cleanup_net
[  104.023450] RIP: 0010:netdev_queue_release+0x55/0xa0
[  104.023892] Code: 48 ab 74 0a c7 07 00 00 00 00 48 83 c7 04 40 f6 c6 02 74 0a 31 c0 48 83 c7 02 66 89 47 fe 83 e6 01 74 03 c6 07 00 49 8b 40 e8 <48> 8b 80 b8 04 00 00 65 ff 08 c3 49 8d 78 01 41 c6 00 00 40 b6 3f
[  104.025531] RSP: 0018:ffffa538804d3cc8 EFLAGS: 00010246
[  104.025982] RAX: ffff987900000000 RBX: ffff9879bb277a18 RCX: 0000000000000000
[  104.026638] RDX: ffff9879bb8b30c0 RSI: 0000000000000000 RDI: ffff9879bb277a58
[  104.027374] RBP: ffffffffb615b0e0 R08: ffff9879bb277a18 R09: ffffffffb5323ef3
[  104.028052] R10: ffff9879bda273a0 R11: fffff43400d73100 R12: ffff9879bbf73a20
[  104.029397] R13: ffff9879bb277a18 R14: 0000000000000000 R15: ffffa538804d3e38
[  104.030741] FS:  0000000000000000(0000) GS:ffff9879bda00000(0000) knlGS:0000000000000000
[  104.032082] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  104.033189] CR2: ffff9879000004b8 CR3: 000000001720a001 CR4: 00000000003606f0
[  104.034463] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  104.035894] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  104.037090] Call Trace:
[  104.038012]  kobject_put+0x81/0x1b0
[  104.039167]  netdev_queue_update_kobjects+0xbd/0x140
[  104.040359]  netdev_unregister_kobject+0x58/0x80
[  104.041462]  rollback_registered_many+0x2d5/0x550
[  104.042593]  ? netdev_run_todo+0x4d/0x2c0
[  104.043678]  unregister_netdevice_many+0x17/0x70
[  104.044853]  default_device_exit_batch+0x131/0x150
[  104.045998]  ? do_wait_intr_irq+0xb0/0xb0
[  104.047282]  cleanup_net+0x1a9/0x2a0
[  104.048323]  process_one_work+0x15b/0x370
[  104.049384]  worker_thread+0x49/0x3e0
[  104.050406]  kthread+0xf8/0x130
[  104.051396]  ? process_one_work+0x370/0x370
[  104.052646]  ? kthread_park+0xb0/0xb0
[  104.053970]  ret_from_fork+0x35/0x40
[  104.055143] Modules linked in: tcp_diag inet_diag xt_NFQUEUE ip6_tables intel_rapl_msr intel_rapl_common iosf_mbi isst_if_common nfit crct10dif_pclmul crc32_pclmul ghash_clmulni_intel pcbc aesni_intel crypto_simd cryptd glue_helper kpatch_5902278(OK) psmouse mousedev pcspkr kpatch(O) pvpanic i2c_piix4 sunrpc ip_tables ata_generic pata_acpi cirrus drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops ttm drm ata_piix crc32c_intel serio_raw uhci_hcd i2c_core libata floppy [last unloaded: kpatch_xfkpQ0nwgmO]
[  104.064254] CR2: ffff9879000004b8
[  104.065832] ---[ end trace 7a2c6cfbc71f5ecf ]---
[  104.067687] RIP: 0010:netdev_queue_release+0x55/0xa0
[  104.069192] Code: 48 ab 74 0a c7 07 00 00 00 00 48 83 c7 04 40 f6 c6 02 74 0a 31 c0 48 83 c7 02 66 89 47 fe 83 e6 01 74 03 c6 07 00 49 8b 40 e8 <48> 8b 80 b8 04 00 00 65 ff 08 c3 49 8d 78 01 41 c6 00 00 40 b6 3f
[  104.073459] RSP: 0018:ffffa538804d3cc8 EFLAGS: 00010246
[  104.075654] RAX: ffff987900000000 RBX: ffff9879bb277a18 RCX: 0000000000000000
[  104.077569] RDX: ffff9879bb8b30c0 RSI: 0000000000000000 RDI: ffff9879bb277a58
[  104.079289] RBP: ffffffffb615b0e0 R08: ffff9879bb277a18 R09: ffffffffb5323ef3
[  104.081150] R10: ffff9879bda273a0 R11: fffff43400d73100 R12: ffff9879bbf73a20
[  104.083570] R13: ffff9879bb277a18 R14: 0000000000000000 R15: ffffa538804d3e38
[  104.085397] FS:  0000000000000000(0000) GS:ffff9879bda00000(0000) knlGS:0000000000000000
[  104.087283] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  104.088899] CR2: ffff9879000004b8 CR3: 000000001720a001 CR4: 00000000003606f0
[  104.090584] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  104.092251] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  104.093895] Kernel panic - not syncing: Fatal exception
[  104.099305] Kernel Offset: 0x34000000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)

问题原因

Linux内核的Netfilter模块在实现IPT_SO_SET_REPLACE或IP6T_SO_SET_REPLACE setsockopt时存在堆越界写入漏洞，该漏洞将允许本地用户通过用户名空间获取权限提升，该漏洞在KCTF中被用于攻击Kubernetes集群中的Pod容器，从而导致实现虚拟化逃逸。该漏洞已在Linux内核中存在15年。更多说明请参见Linux: Heap Out-Of-Bounds Write in xt_compat_target_from_user。

解决方案

当遇到该问题时，您可以参考以下方案处理。

1. 登录ECS实例，详情请参见连接方式概述。

2. 执行以下命令，确认系统内核版本。

   uname -r

   系统显示类似如下。

    4.19.91-21.al7.x86_64

3. 请根据系统内核版本，选择以下对应的解决方法：

   • 4.19.91-19.1.al7.x86_64（不含）之前的版本

     1. 更新操作系统版本至最新的内核版本。

        yum update kernel

     2. 重启服务器生效。

        reboot

     3. 若最新内核版本的操作系统同样存在该问题，请参见4.19.91-19.1.al7.x86_64（包含）到4.19.91-24.al7.x86_64（包含）之间版本的解决方案更新内核热补丁。

   • 对于4.19.91-19.1.al7.x86_64（包含）到4.19.91-24.al7.x86_64（包含）之间的版本，可通过安装内核热补丁解决，安装命令如下。

     yum install -y kernel-hotfix-5928799-`uname -r | awk -F"-" '{print $NF}'`