@Hly2700w ,@dengmengmian ,@georgecao ,@zhongjun2 ,@yao-xiaobai ,@openeuler-ci-bot ,@openeuler-infra-bot ,@LiYanghang00 ,@ibforu ,@zhujianwei001 ,@kaitiandu ,@htforge ,@chiqijun ,@allen-shi ,@yeweihua999 ,@shu-shengming ,@oekernel ,@stavewu ,@wkfxxx ,@TrueAI ,@xukuohai ,@kevinzhu1 ,@wsoydl ,@koishimind ,@yuehaibing_planb ,@liulongfang ,@hongwu-wang ,@kile2009 ,@Tankll2021 ,@kazero00 ,@hu-chunzhi ,@mingqian218472 ,@chriszjh ,@zeng_zhaorong ,@gaojuxin09 ,@zhangyi089 ,@yonghu_4dc5 ,@stkid ,@young-sun ,@hanjunguo ,@rock_hw ,@chenjiesong ,@xingmz1 ,@caixu-blue ,@mufengyan ,@guzitao ,@hanliyang ,@zhengzengkai ,@sanglipeng ,@duanqiangwen ,@fangfeng123 ,@whoisxxx ,@SuperSix173 ,@hellotcc ,@zhang-changzhong ,@lostway1 ,@gongleihuawei ,@li-huisong ,@hjx_gitff ,@junlong-zheng ,@fanghaiqinghw ,@chenke2026 ,@lujialin2 ,@ibforu2nd ,@LiuYongQiang0816 ,@jerry_lilijun ,@linan888 ,@linyunsheng ,@zqiao216 ,@markyuan4ta21 ,@openLiBingCI ,@openLiBing-bot ,@linqian0322 ,@wenjunryou
issue处理注意事项:
1. 当前issue受影响的分支提交pr时, 须在pr描述中填写当前issue编号进行关联, 否则无法关闭当前issue;
2. 模板内容需要填写完整, 无论是受影响或者不受影响都需要填写完整内容,未引入的分支不需要填写, 否则无法关闭当前issue;
3. 以下为模板中需要填写完整的内容, 请复制到评论区回复, 注: 内容的标题名称(影响性分析说明, openEuler评分, 受影响版本排查(受影响/不受影响), 修复是否涉及abi变化(是/否), 原因说明)不能省略,省略后cve-manager将无法正常解析填写内容.

影响性分析说明:

openEuler评分: (评分和向量)

受影响版本排查(受影响/不受影响):
1.master(6.12.33):
2.openEuler-20.03-LTS-SP4(4.19.90):
3.openEuler-22.03-LTS-SP3(5.10.0):
4.openEuler-22.03-LTS-SP4(5.10.0):
5.openEuler-24.03-LTS(6.6.0):
6.openEuler-24.03-LTS-Next(6.6.0):
7.openEuler-24.03-LTS-SP1(6.6.0):
8.openEuler-24.03-LTS-SP2(6.6.0):
9.openEuler-24.03-LTS-SP3(6.6.0):

修复是否涉及abi变化(是/否)：
1.master(6.12.33):
2.openEuler-20.03-LTS-SP4(4.19.90):
3.openEuler-22.03-LTS-SP3(5.10.0):
4.openEuler-22.03-LTS-SP4(5.10.0):
5.openEuler-24.03-LTS(6.6.0):
6.openEuler-24.03-LTS-Next(6.6.0):
7.openEuler-24.03-LTS-SP1(6.6.0):
8.openEuler-24.03-LTS-SP2(6.6.0):
9.openEuler-24.03-LTS-SP3(6.6.0):

原因说明：
1.master(6.12.33):
2.openEuler-20.03-LTS-SP4(4.19.90):
3.openEuler-22.03-LTS-SP3(5.10.0):
4.openEuler-22.03-LTS-SP4(5.10.0):
5.openEuler-24.03-LTS(6.6.0):
6.openEuler-24.03-LTS-Next(6.6.0):
7.openEuler-24.03-LTS-SP1(6.6.0):
8.openEuler-24.03-LTS-SP2(6.6.0):
9.openEuler-24.03-LTS-SP3(6.6.0):

原因说明填写请参考下方表格(注意：版本是否受影响和版本的原因说明必须对应，例如master版本分支受影响，那原因说明只能是受影响对应的原因之一!)：

issue处理具体操作请参考:
https://gitcode.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
pr关联issue具体操作请参考:
https://docs.gitcode.com/docs/help/home/org_project/pullrequests/pr-related-issue

Welcome To openEuler Community

Hey @openeuler-ci-bot , thanks for your contribution to the community.

Bot Usage Manual

I'm the Bot here serving you. You can find the instructions on how to interact with me at Here . That means you can comment below every pull request or issue to trigger Bot Commands.

Contact Guide

If you have any questions, please contact the SIG: Kernel ,
and any of the maintainers: @hanjunguo, @oekernel, @sanglipeng, @zeng_zhaorong, @zhengzengkai ,
and any of the committers: @LiuYongQiang0816, @SuperSix173, @Tankll2021, @TrueAI, @allen-shi, @caixu-blue, @chenjiesong, @chenke2026, @chiqijun, @chriszjh, @duanqiangwen, @fangfeng123, @fanghaiqinghw, @gaojuxin09, @gongleihuawei, @guzitao, @hanjunguo, @hanliyang, @hellotcc, @hjx_gitff, @hongwu-wang, @htforge, @hu-chunzhi, @jackknight, @jerry_lilijun, @junlong-zheng, @kaitiandu, @kazero00, @kevinzhu1, @kile2009, @koishimind, @li-huisong, @linan888, @linyunsheng, @liulongfang, @lostway1, @lujialin2, @markyuan4ta21, @mingqian218472, @mufengyan, @qinirao, @robinorg, @rock_hw, @sanglipeng, @shu-shengming, @shuaijiakun, @stavewu, @stkid, @whoisxxx, @wkfxxx, @wsoydl, @xingmz1, @xukuohai, @yeweihua999, @yonghu_4dc5, @young-sun, @yuehaibing_planb, @yuzenghui1, @zhang-changzhong, @zhangyi089, @zhujianwei001, @zichengqu, @zqiao216 .

说明：补丁链接仅供初步排查参考，实际可用性请人工再次确认，补丁下载验证可使用CVE补丁工具。
若补丁不准确，烦请在此issue下评论 '/report-patch 参考网址 补丁链接1,补丁链接2' 反馈正确信息，便于我们不断优化工具，不胜感激。
如 /report-patch https://security-tracker.debian.org/tracker/CVE-2021-3997 https://github.com/systemd/systemd/commit/5b1cf7a9be37e20133c0208005274ce4a5b5c6a1

CVE-2023-54132

影响性分析说明：
In the Linux kernel, the following vulnerability has been resolved:

erofs: stop parsing non-compact HEAD index if clusterofs is invalid

Syzbot generated a crafted image [1] with a non-compact HEAD index of
clusterofs 33024 while valid numbers should be 0 ~ lclustersize-1,
which causes the following unexpected behavior as below:

BUG: unable to handle page fault for address: fffff52101a3fff9
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 23ffed067 P4D 23ffed067 PUD 0
Oops: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 4398 Comm: kworker/u5:1 Not tainted 6.3.0-rc6-syzkaller-g09a9639e56c0 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023
Workqueue: erofs_worker z_erofs_decompressqueue_work
RIP: 0010:z_erofs_decompress_queue+0xb7e/0x2b40
...
Call Trace:
<TASK>
z_erofs_decompressqueue_work+0x99/0xe0
process_one_work+0x8f6/0x1170
worker_thread+0xa63/0x1210
kthread+0x270/0x300
ret_from_fork+0x1f/0x30

Note that normal images or images using compact indexes are not
impacted. Let's fix this now.

[1] https://lore.kernel.org/r/000000000000ec75b005ee97fbaa@google.com

The Linux kernel CVE team has assigned CVE-2023-54132 to this issue.

openEuler评分:(评分和向量)
5.5
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

受影响版本排查(受影响/不受影响):
1.master(6.1.0):不受影响
2.openEuler-20.03-LTS-SP4:受影响
3.openEuler-22.03-LTS-SP3:不受影响
4.openEuler-22.03-LTS-SP4:不受影响
5.openEuler-24.03-LTS:不受影响
6.openEuler-24.03-LTS-Next:不受影响
7.openEuler-24.03-LTS-SP1:不受影响
8.openEuler-24.03-LTS-SP2:不受影响
9.openEuler-24.03-LTS-SP3:不受影响

修复是否涉及abi变化(是/否)：
1.master(6.1.0):否
2.openEuler-20.03-LTS-SP4:否
3.openEuler-22.03-LTS-SP3:否
4.openEuler-22.03-LTS-SP4:否
5.openEuler-24.03-LTS:否
6.openEuler-24.03-LTS-Next:否
7.openEuler-24.03-LTS-SP1:否
8.openEuler-24.03-LTS-SP2:否
9.openEuler-24.03-LTS-SP3:否

原因说明：
1.master(23.08.5):不受影响-漏洞代码不能被攻击者触发
2.openEuler-20.03-LTS-SP4:不修复-超出修复范围
3.openEuler-22.03-LTS-SP3:不受影响-漏洞代码不能被攻击者触发
4.openEuler-22.03-LTS-SP4:不受影响-漏洞代码不能被攻击者触发
5.openEuler-24.03-LTS:不受影响-漏洞代码不能被攻击者触发
6.openEuler-24.03-LTS-Next:不受影响-漏洞代码不能被攻击者触发
7.openEuler-24.03-LTS-SP1:不受影响-漏洞代码不能被攻击者触发
8.openEuler-24.03-LTS-SP2:不受影响-漏洞代码不能被攻击者触发
9.openEuler-24.03-LTS-SP3:不受影响-漏洞代码不能被攻击者触发

@duanqiangwen 经过 cve-manager 解析, 已分析的内容如下表所示:

请确认分析内容的准确性, 确认无误后, 您可以进行后续步骤, 否则您可以继续分析.