From 034973763716fe763707ddf7da0a0c1862e66712 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E9=86=89=E8=88=9E=E7=BB=8F=E9=98=81=E5=8D=8A=E5=8D=B7?= =?UTF-8?q?=E4=B9=A6?= <1965473687@qq.com> Date: Fri, 6 Dec 2024 21:05:52 +0800 Subject: [PATCH 1/2] SSTSTestcases/2024/09 --- .../09/CVE-2024-36489/CVE-2024-36489.json | 118 ++++++++++++++++++ .../09/CVE-2024-36489/CVE-2024-36489.yara | 33 +++++ .../09/CVE-2024-38577/CVE-2024-38577.json | 118 ++++++++++++++++++ .../09/CVE-2024-38577/CVE-2024-38577.yara | 33 +++++ .../09/CVE-2024-38588/CVE-2024-38588.json | 118 ++++++++++++++++++ .../09/CVE-2024-38588/CVE-2024-38588.yara | 33 +++++ 6 files changed, 453 insertions(+) create mode 100644 vulntest/SSTSTestcases/2024/09/CVE-2024-36489/CVE-2024-36489.json create mode 100644 vulntest/SSTSTestcases/2024/09/CVE-2024-36489/CVE-2024-36489.yara create mode 100644 vulntest/SSTSTestcases/2024/09/CVE-2024-38577/CVE-2024-38577.json create mode 100644 vulntest/SSTSTestcases/2024/09/CVE-2024-38577/CVE-2024-38577.yara create mode 100644 vulntest/SSTSTestcases/2024/09/CVE-2024-38588/CVE-2024-38588.json create mode 100644 vulntest/SSTSTestcases/2024/09/CVE-2024-38588/CVE-2024-38588.yara diff --git a/vulntest/SSTSTestcases/2024/09/CVE-2024-36489/CVE-2024-36489.json b/vulntest/SSTSTestcases/2024/09/CVE-2024-36489/CVE-2024-36489.json new file mode 100644 index 0000000..440dbe2 --- /dev/null +++ b/vulntest/SSTSTestcases/2024/09/CVE-2024-36489/CVE-2024-36489.json @@ -0,0 +1,118 @@ +{ + "month": "2024-06", + "release_time": "2024-06-21 7:15:10", + "vulnerabilities": [ + { + "month": "2024-09", + "vul_id": { + "cve": "CVE-2024-36489", + "openharmony-sa": "" + }, + "severity": "medium", + "vul_description": { + "zh": "该漏洞与 Linux 内核处理某些系统调用的方式不正确有关，可能导致权限提升。", + "en": "This vulnerability is associated with improper handling of certain system calls in the Linux kernel, potentially leading to privilege escalation." + }, + "vul_impact": { + "zh": "本地攻击者可以通过利用此漏洞获取未授权的系统访问权限。", + "en": "Local attackers can exploit this vulnerability to gain unauthorized system access." + }, + "disclosure": { + "zh": "https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-09.md", + "en": "https://gitee.com/openharmony/security/blob/master/en/security-disclosure/2024/2024-09.md" + }, + "patch_info": { + "3.0.x": { + "patch_url": [ + "https://gitee.com/openharmony/kernel_linux_5.10/commit/076cf87c1aaa46da90a2789c03de07270c6299e9" + ], + "patch_file": [ + "https://gitee.com/openharmony/kernel_linux_5.10/commit/076cf87c1aaa46da90a2789c03de07270c6299e9.patch" + ], + "diff_file": [ + "https://gitee.com/openharmony/kernel_linux_5.10/commit/076cf87c1aaa46da90a2789c03de07270c6299e9.diff" + ] + } + }, + "affected_projects": "kernel_linux_5.10", + "object_type": "kernel_linux", + "affected_versions": [ + "4.0.0-4.0.2" + ], + "affected_device": { + "mini": { + "liteos": { + "rics-v": { + "scan_strategy": { + "ssts": { + "enable": false + }, + "ists": { + "enable": false + } + } + } + } + }, + "small": { + "liteos": { + "rics-v": { + "scan_strategy": { + "ssts": { + "enable": false + }, + "ists": { + "enable": false + } + } + } + }, + "linux": { + "arm": { + "scan_strategy": { + "ssts": { + "enable": false + }, + "ists": { + "enable": false + } + } + } + } + }, + "standard": { + "linux": { + "arm": { + "scan_strategy": { + "ssts": { + "enable": false + }, + "ists": { + "enable": true, + "yara": { + "affected_files": [ + "/dev/block/platform/fe310000.sdhci/by-name/boot_linux" + ], + "yara_rules": [ + "CVE-2024-36489.yara" + ] + } + } + } + }, + "arm64": { + "scan_strategy": { + "ssts": { + "enable": false + }, + "ists": { + "enable": false + } + } + } + } + } + } + } + ] +} \ No newline at end of file diff --git a/vulntest/SSTSTestcases/2024/09/CVE-2024-36489/CVE-2024-36489.yara b/vulntest/SSTSTestcases/2024/09/CVE-2024-36489/CVE-2024-36489.yara new file mode 100644 index 0000000..b916888 --- /dev/null +++ b/vulntest/SSTSTestcases/2024/09/CVE-2024-36489/CVE-2024-36489.yara @@ -0,0 +1,33 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +import "console" + +rule CVE_2024_36489 +{ + meta: + date="2024-12-06" + openharmony_sa="" + cve="CVE-2024-36489" + affected_files="/dev/block/platform/fe310000.sdhci/by-name/boot_linux" + + strings: + + $fix = {7B 6A BF 97 68 A2 00 91 69 A2 15 91 08 FD DF C8 88 4E 0B A9 34 FD 9F C8} + + condition: + $fix and console.log("CVE-2024-36489 testcase pass") + } \ No newline at end of file diff --git a/vulntest/SSTSTestcases/2024/09/CVE-2024-38577/CVE-2024-38577.json b/vulntest/SSTSTestcases/2024/09/CVE-2024-38577/CVE-2024-38577.json new file mode 100644 index 0000000..0123fca --- /dev/null +++ b/vulntest/SSTSTestcases/2024/09/CVE-2024-38577/CVE-2024-38577.json @@ -0,0 +1,118 @@ +{ + "month": "2024-06", + "release_time": "2024-06-19 10:15:17", + "vulnerabilities": [ + { + "month": "2024-09", + "vul_id": { + "cve": "CVE-2024-38577", + "openharmony-sa": "" + }, + "severity": "high", + "vul_description": { + "zh": "这是一个缓冲区溢出漏洞，存在于 Linux 内核的 show_rcu_tasks_trace_gp_kthread 函数中。当传递给 sprintf() 的计数值过大时，可能导致缓冲区溢出。", + "en": "A buffer overflow vulnerability in the Linux kernel's show_rcu_tasks_trace_gp_kthread function occurs when excessively large counter values are passed to sprintf()." + }, + "vul_impact": { + "zh": "可能导致拒绝服务(DoS)或异常行为。", + "en": "May result in denial of service (DoS)or unexpected behavior." + }, + "disclosure": { + "zh": "https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-09.md", + "en": "https://gitee.com/openharmony/security/blob/master/en/security-disclosure/2024/2024-09.md" + }, + "patch_info": { + "3.0.x": { + "patch_url": [ + "https://gitee.com/openharmony/kernel_linux_5.10/commit/7c7eff748e303121d6b1a22f2f37dfec07ec7bf0" + ], + "patch_file": [ + "https://gitee.com/openharmony/kernel_linux_5.10/commit/7c7eff748e303121d6b1a22f2f37dfec07ec7bf0.patch" + ], + "diff_file": [ + "https://gitee.com/openharmony/kernel_linux_5.10/commit/7c7eff748e303121d6b1a22f2f37dfec07ec7bf0.diff" + ] + } + }, + "affected_projects": "kernel_linux_5.10", + "object_type": "kernel_linux", + "affected_versions": [ + "4.0.0-4.0.2" + ], + "affected_device": { + "mini": { + "liteos": { + "rics-v": { + "scan_strategy": { + "ssts": { + "enable": false + }, + "ists": { + "enable": false + } + } + } + } + }, + "small": { + "liteos": { + "rics-v": { + "scan_strategy": { + "ssts": { + "enable": false + }, + "ists": { + "enable": false + } + } + } + }, + "linux": { + "arm": { + "scan_strategy": { + "ssts": { + "enable": false + }, + "ists": { + "enable": false + } + } + } + } + }, + "standard": { + "linux": { + "arm": { + "scan_strategy": { + "ssts": { + "enable": false + }, + "ists": { + "enable": true, + "yara": { + "affected_files": [ + "/dev/block/platform/fe310000.sdhci/by-name/boot_linux" + ], + "yara_rules": [ + "CVE-2024-38577.yara" + ] + } + } + } + }, + "arm64": { + "scan_strategy": { + "ssts": { + "enable": false + }, + "ists": { + "enable": false + } + } + } + } + } + } + } + ] +} \ No newline at end of file diff --git a/vulntest/SSTSTestcases/2024/09/CVE-2024-38577/CVE-2024-38577.yara b/vulntest/SSTSTestcases/2024/09/CVE-2024-38577/CVE-2024-38577.yara new file mode 100644 index 0000000..3e7cbad --- /dev/null +++ b/vulntest/SSTSTestcases/2024/09/CVE-2024-38577/CVE-2024-38577.yara @@ -0,0 +1,33 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +import "console" + +rule CVE_2024_38577 +{ + meta: + date="2024-12-06" + openharmony_sa="" + cve="CVE-2024-38577" + affected_files="/dev/block/platform/fe310000.sdhci/by-name/boot_linux" + + strings: + + $fix = {06 61 41 F9 E0 23 00 91 01 08 80 52 64 45 19 94} + + condition: + $fix and console.log("CVE-2024-38577 testcase pass") + } \ No newline at end of file diff --git a/vulntest/SSTSTestcases/2024/09/CVE-2024-38588/CVE-2024-38588.json b/vulntest/SSTSTestcases/2024/09/CVE-2024-38588/CVE-2024-38588.json new file mode 100644 index 0000000..f474c5b --- /dev/null +++ b/vulntest/SSTSTestcases/2024/09/CVE-2024-38588/CVE-2024-38588.json @@ -0,0 +1,118 @@ +{ + "month": "2024-06", + "release_time": "2024-06-19 10:15:18", + "vulnerabilities": [ + { + "month": "2024-09", + "vul_id": { + "cve": "CVE-2024-38588", + "openharmony-sa": "" + }, + "severity": "high", + "vul_description": { + "zh": "此漏洞影响 Linux 内核的某些子系统，涉及访问控制不当的问题。虽然具体细节尚未完全公开，但该漏洞被标记为中等风险，可能在特定条件下被利用来提升权限或执行未经授权的操作。", + "en": "This vulnerability affects certain subsystems of the Linux kernel, involving improper access control. While specific details are not fully disclosed, the vulnerability is rated medium risk and may be exploited under certain conditions to elevate privileges or perform unauthorized actions." + }, + "vul_impact": { + "zh": "可能允许攻击者在某些条件下执行未经授权的操作，建议及时更新内核。", + "en": "May allow attackers to perform unauthorized actions under certain conditions. Updating the kernel is recommended." + }, + "disclosure": { + "zh": "https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-09.md", + "en": "https://gitee.com/openharmony/security/blob/master/en/security-disclosure/2024/2024-09.md" + }, + "patch_info": { + "3.0.x": { + "patch_url": [ + "https://gitee.com/openharmony/kernel_linux_5.10/commit/25f2ac58b8a2d1266ca736c1c6eaed4dc1b1b3f7" + ], + "patch_file": [ + "https://gitee.com/openharmony/kernel_linux_5.10/commit/25f2ac58b8a2d1266ca736c1c6eaed4dc1b1b3f7.patch" + ], + "diff_file": [ + "https://gitee.com/openharmony/kernel_linux_5.10/commit/25f2ac58b8a2d1266ca736c1c6eaed4dc1b1b3f7.diff" + ] + } + }, + "affected_projects": "kernel_linux_5.10", + "object_type": "kernel_linux", + "affected_versions": [ + "4.0.0-4.0.2" + ], + "affected_device": { + "mini": { + "liteos": { + "rics-v": { + "scan_strategy": { + "ssts": { + "enable": false + }, + "ists": { + "enable": false + } + } + } + } + }, + "small": { + "liteos": { + "rics-v": { + "scan_strategy": { + "ssts": { + "enable": false + }, + "ists": { + "enable": false + } + } + } + }, + "linux": { + "arm": { + "scan_strategy": { + "ssts": { + "enable": false + }, + "ists": { + "enable": false + } + } + } + } + }, + "standard": { + "linux": { + "arm": { + "scan_strategy": { + "ssts": { + "enable": false + }, + "ists": { + "enable": true, + "yara": { + "affected_files": [ + "/dev/block/platform/fe310000.sdhci/by-name/boot_linux" + ], + "yara_rules": [ + "CVE-2024-38588.yara" + ] + } + } + } + }, + "arm64": { + "scan_strategy": { + "ssts": { + "enable": false + }, + "ists": { + "enable": false + } + } + } + } + } + } + } + ] +} \ No newline at end of file diff --git a/vulntest/SSTSTestcases/2024/09/CVE-2024-38588/CVE-2024-38588.yara b/vulntest/SSTSTestcases/2024/09/CVE-2024-38588/CVE-2024-38588.yara new file mode 100644 index 0000000..be01934 --- /dev/null +++ b/vulntest/SSTSTestcases/2024/09/CVE-2024-38588/CVE-2024-38588.yara @@ -0,0 +1,33 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +import "console" + +rule CVE_2024_38588 +{ + meta: + date="2024-12-06" + openharmony_sa="" + cve="CVE-2024-38588" + affected_files="/dev/block/platform/fe310000.sdhci/by-name/boot_linux" + + strings: + + $fix = {93 00 00 B4 3D 4D FE 97 E0 03 13 AA 1D 00 00 94} + + condition: + $fix and console.log("CVE-2024-38588 testcase pass") + } \ No newline at end of file -- Gitee From 640ec480ae16f3383728163f17e139f9800dba5b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E9=86=89=E8=88=9E=E7=BB=8F=E9=98=81=E5=8D=8A=E5=8D=B7?= =?UTF-8?q?=E4=B9=A6?= <1965473687@qq.com> Date: Fri, 6 Dec 2024 21:10:02 +0800 Subject: [PATCH 2/2] 09 --- .../{CVE-2024-36489.json => TestCaseRule-CVE-2024-36489.json} | 0 .../{CVE-2024-36489.yara => TestCaseRule-CVE-2024-36489.yara} | 0 .../{CVE-2024-38577.json => TestCaseRule-CVE-2024-38577.json} | 0 .../{CVE-2024-38577.yara => TestCaseRule-CVE-2024-38577.yara} | 0 .../{CVE-2024-38588.json => TestCaseRule-CVE-2024-38588.json} | 0 .../{CVE-2024-38588.yara => TestCaseRule-CVE-2024-38588.yara} | 0 6 files changed, 0 insertions(+), 0 deletions(-) rename vulntest/SSTSTestcases/2024/09/CVE-2024-36489/{CVE-2024-36489.json => TestCaseRule-CVE-2024-36489.json} (100%) rename vulntest/SSTSTestcases/2024/09/CVE-2024-36489/{CVE-2024-36489.yara => TestCaseRule-CVE-2024-36489.yara} (100%) rename vulntest/SSTSTestcases/2024/09/CVE-2024-38577/{CVE-2024-38577.json => TestCaseRule-CVE-2024-38577.json} (100%) rename vulntest/SSTSTestcases/2024/09/CVE-2024-38577/{CVE-2024-38577.yara => TestCaseRule-CVE-2024-38577.yara} (100%) rename vulntest/SSTSTestcases/2024/09/CVE-2024-38588/{CVE-2024-38588.json => TestCaseRule-CVE-2024-38588.json} (100%) rename vulntest/SSTSTestcases/2024/09/CVE-2024-38588/{CVE-2024-38588.yara => TestCaseRule-CVE-2024-38588.yara} (100%) diff --git a/vulntest/SSTSTestcases/2024/09/CVE-2024-36489/CVE-2024-36489.json b/vulntest/SSTSTestcases/2024/09/CVE-2024-36489/TestCaseRule-CVE-2024-36489.json similarity index 100% rename from vulntest/SSTSTestcases/2024/09/CVE-2024-36489/CVE-2024-36489.json rename to vulntest/SSTSTestcases/2024/09/CVE-2024-36489/TestCaseRule-CVE-2024-36489.json diff --git a/vulntest/SSTSTestcases/2024/09/CVE-2024-36489/CVE-2024-36489.yara b/vulntest/SSTSTestcases/2024/09/CVE-2024-36489/TestCaseRule-CVE-2024-36489.yara similarity index 100% rename from vulntest/SSTSTestcases/2024/09/CVE-2024-36489/CVE-2024-36489.yara rename to vulntest/SSTSTestcases/2024/09/CVE-2024-36489/TestCaseRule-CVE-2024-36489.yara diff --git a/vulntest/SSTSTestcases/2024/09/CVE-2024-38577/CVE-2024-38577.json b/vulntest/SSTSTestcases/2024/09/CVE-2024-38577/TestCaseRule-CVE-2024-38577.json similarity index 100% rename from vulntest/SSTSTestcases/2024/09/CVE-2024-38577/CVE-2024-38577.json rename to vulntest/SSTSTestcases/2024/09/CVE-2024-38577/TestCaseRule-CVE-2024-38577.json diff --git a/vulntest/SSTSTestcases/2024/09/CVE-2024-38577/CVE-2024-38577.yara b/vulntest/SSTSTestcases/2024/09/CVE-2024-38577/TestCaseRule-CVE-2024-38577.yara similarity index 100% rename from vulntest/SSTSTestcases/2024/09/CVE-2024-38577/CVE-2024-38577.yara rename to vulntest/SSTSTestcases/2024/09/CVE-2024-38577/TestCaseRule-CVE-2024-38577.yara diff --git a/vulntest/SSTSTestcases/2024/09/CVE-2024-38588/CVE-2024-38588.json b/vulntest/SSTSTestcases/2024/09/CVE-2024-38588/TestCaseRule-CVE-2024-38588.json similarity index 100% rename from vulntest/SSTSTestcases/2024/09/CVE-2024-38588/CVE-2024-38588.json rename to vulntest/SSTSTestcases/2024/09/CVE-2024-38588/TestCaseRule-CVE-2024-38588.json diff --git a/vulntest/SSTSTestcases/2024/09/CVE-2024-38588/CVE-2024-38588.yara b/vulntest/SSTSTestcases/2024/09/CVE-2024-38588/TestCaseRule-CVE-2024-38588.yara similarity index 100% rename from vulntest/SSTSTestcases/2024/09/CVE-2024-38588/CVE-2024-38588.yara rename to vulntest/SSTSTestcases/2024/09/CVE-2024-38588/TestCaseRule-CVE-2024-38588.yara -- Gitee