In the Linux kernel, the following vulnerability has been resolved:
libceph: fix race between delayedwork() and cephmonc_stop()
The way the delayed work is handled in cephmoncstop() is prone to races with monfault() and possibly also finishhunting(). Both of these can requeue the delayed work which wouldn't be canceled by any of the following code in case that happens after canceldelayedworksync() runs -- _closesession() doesn't mess with the delayed work in order to avoid interfering with the hunting interval logic. This part was missed in commit b5d91704f53e ("libceph: behave in monfault() if cur_mon < 0") and use-after-free can still ensue on monc and objects that hang off of it, with monc->auth and monc->monmap being particularly susceptible to quickly being reused.
To fix this:
[
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"169584702279682524563917184423514721030",
"71087387267687637643731295453117568874",
"39670781859956872858406102538225166685",
"26307991143692803026588163230133146815",
"54969059580525060424990163339726744658",
"52407694445482389239303823098907231636",
"302439920907010895457930437496718091611",
"11232637764709653059865479373686017537",
"82561163208885199497412567751007014043",
"323031361195031267460039519394641615449",
"226191764916406091661884830137188347300",
"304069801657105906744000750077144321506",
"312499255660910590788382089600333900237",
"111486169807242549370725069003465958961",
"36778853295281570416879496219020074075",
"49790940796228197419672597576114378746",
"96308326152686475496289421174771427173",
"220060524447845941323372784775888320959",
"294140909990819676340129133965065546465",
"316561615879993456390283050973363039134",
"60514240412469533972913727466118101420",
"297559882044707025863690354315205989482"
]
},
"target": {
"file": "net/ceph/mon_client.c"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9525af1f58f67df387768770fcf6d6a8f23aee3d",
"id": "CVE-2024-42232-3403a755"
},
{
"digest": {
"length": 490.0,
"function_hash": "256317781218876920102725190621516252693"
},
"target": {
"function": "ceph_monc_stop",
"file": "net/ceph/mon_client.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2d33654d40a05afd91ab24c9a73ab512a0670a9a",
"id": "CVE-2024-42232-3814caa7"
},
{
"digest": {
"length": 490.0,
"function_hash": "256317781218876920102725190621516252693"
},
"target": {
"function": "ceph_monc_stop",
"file": "net/ceph/mon_client.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@63e5d035e3a7ab7412a008f202633c5e6a0a28ea",
"id": "CVE-2024-42232-59808d8a"
},
{
"digest": {
"length": 490.0,
"function_hash": "256317781218876920102725190621516252693"
},
"target": {
"function": "ceph_monc_stop",
"file": "net/ceph/mon_client.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@20cf67dcb7db842f941eff1af6ee5e9dc41796d7",
"id": "CVE-2024-42232-5ccf883a"
},
{
"digest": {
"length": 927.0,
"function_hash": "33097678824327037917235092340764833582"
},
"target": {
"function": "delayed_work",
"file": "net/ceph/mon_client.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@20cf67dcb7db842f941eff1af6ee5e9dc41796d7",
"id": "CVE-2024-42232-703b95f0"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"169584702279682524563917184423514721030",
"71087387267687637643731295453117568874",
"39670781859956872858406102538225166685",
"26307991143692803026588163230133146815",
"54969059580525060424990163339726744658",
"52407694445482389239303823098907231636",
"302439920907010895457930437496718091611",
"11232637764709653059865479373686017537",
"82561163208885199497412567751007014043",
"323031361195031267460039519394641615449",
"226191764916406091661884830137188347300",
"304069801657105906744000750077144321506",
"312499255660910590788382089600333900237",
"111486169807242549370725069003465958961",
"36778853295281570416879496219020074075",
"49790940796228197419672597576114378746",
"96308326152686475496289421174771427173",
"220060524447845941323372784775888320959",
"294140909990819676340129133965065546465",
"316561615879993456390283050973363039134",
"60514240412469533972913727466118101420",
"297559882044707025863690354315205989482"
]
},
"target": {
"file": "net/ceph/mon_client.c"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1177afeca833174ba83504688eec898c6214f4bf",
"id": "CVE-2024-42232-8a986cea"
},
{
"digest": {
"length": 927.0,
"function_hash": "33097678824327037917235092340764833582"
},
"target": {
"function": "delayed_work",
"file": "net/ceph/mon_client.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@69c7b2fe4c9cc1d3b1186d1c5606627ecf0de883",
"id": "CVE-2024-42232-8b96840f"
},
{
"digest": {
"length": 927.0,
"function_hash": "33097678824327037917235092340764833582"
},
"target": {
"function": "delayed_work",
"file": "net/ceph/mon_client.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@63e5d035e3a7ab7412a008f202633c5e6a0a28ea",
"id": "CVE-2024-42232-8e96490d"
},
{
"digest": {
"length": 927.0,
"function_hash": "33097678824327037917235092340764833582"
},
"target": {
"function": "delayed_work",
"file": "net/ceph/mon_client.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2d33654d40a05afd91ab24c9a73ab512a0670a9a",
"id": "CVE-2024-42232-8f3471f1"
},
{
"digest": {
"length": 927.0,
"function_hash": "33097678824327037917235092340764833582"
},
"target": {
"function": "delayed_work",
"file": "net/ceph/mon_client.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9525af1f58f67df387768770fcf6d6a8f23aee3d",
"id": "CVE-2024-42232-9c9725a2"
},
{
"digest": {
"length": 490.0,
"function_hash": "256317781218876920102725190621516252693"
},
"target": {
"function": "ceph_monc_stop",
"file": "net/ceph/mon_client.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9525af1f58f67df387768770fcf6d6a8f23aee3d",
"id": "CVE-2024-42232-a10d6fd7"
},
{
"digest": {
"length": 927.0,
"function_hash": "33097678824327037917235092340764833582"
},
"target": {
"function": "delayed_work",
"file": "net/ceph/mon_client.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@34b76d1922e41da1fa73d43b764cddd82ac9733c",
"id": "CVE-2024-42232-a2c9e86e"
},
{
"digest": {
"length": 490.0,
"function_hash": "256317781218876920102725190621516252693"
},
"target": {
"function": "ceph_monc_stop",
"file": "net/ceph/mon_client.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1177afeca833174ba83504688eec898c6214f4bf",
"id": "CVE-2024-42232-abf07934"
},
{
"digest": {
"length": 490.0,
"function_hash": "256317781218876920102725190621516252693"
},
"target": {
"function": "ceph_monc_stop",
"file": "net/ceph/mon_client.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@69c7b2fe4c9cc1d3b1186d1c5606627ecf0de883",
"id": "CVE-2024-42232-c2fe16f4"
},
{
"digest": {
"length": 490.0,
"function_hash": "256317781218876920102725190621516252693"
},
"target": {
"function": "ceph_monc_stop",
"file": "net/ceph/mon_client.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@33d38c5da17f8db2d80e811b7829d2822c10625e",
"id": "CVE-2024-42232-c4c342a1"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"169584702279682524563917184423514721030",
"71087387267687637643731295453117568874",
"39670781859956872858406102538225166685",
"26307991143692803026588163230133146815",
"54969059580525060424990163339726744658",
"52407694445482389239303823098907231636",
"302439920907010895457930437496718091611",
"11232637764709653059865479373686017537",
"82561163208885199497412567751007014043",
"323031361195031267460039519394641615449",
"226191764916406091661884830137188347300",
"304069801657105906744000750077144321506",
"312499255660910590788382089600333900237",
"111486169807242549370725069003465958961",
"36778853295281570416879496219020074075",
"49790940796228197419672597576114378746",
"96308326152686475496289421174771427173",
"220060524447845941323372784775888320959",
"294140909990819676340129133965065546465",
"316561615879993456390283050973363039134",
"60514240412469533972913727466118101420",
"297559882044707025863690354315205989482"
]
},
"target": {
"file": "net/ceph/mon_client.c"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@34b76d1922e41da1fa73d43b764cddd82ac9733c",
"id": "CVE-2024-42232-d136933d"
},
{
"digest": {
"length": 927.0,
"function_hash": "33097678824327037917235092340764833582"
},
"target": {
"function": "delayed_work",
"file": "net/ceph/mon_client.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@33d38c5da17f8db2d80e811b7829d2822c10625e",
"id": "CVE-2024-42232-d84071d6"
},
{
"digest": {
"length": 490.0,
"function_hash": "256317781218876920102725190621516252693"
},
"target": {
"function": "ceph_monc_stop",
"file": "net/ceph/mon_client.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@34b76d1922e41da1fa73d43b764cddd82ac9733c",
"id": "CVE-2024-42232-db9038ce"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"169584702279682524563917184423514721030",
"71087387267687637643731295453117568874",
"39670781859956872858406102538225166685",
"26307991143692803026588163230133146815",
"54969059580525060424990163339726744658",
"52407694445482389239303823098907231636",
"302439920907010895457930437496718091611",
"11232637764709653059865479373686017537",
"82561163208885199497412567751007014043",
"323031361195031267460039519394641615449",
"226191764916406091661884830137188347300",
"304069801657105906744000750077144321506",
"312499255660910590788382089600333900237",
"111486169807242549370725069003465958961",
"36778853295281570416879496219020074075",
"49790940796228197419672597576114378746",
"96308326152686475496289421174771427173",
"220060524447845941323372784775888320959",
"294140909990819676340129133965065546465",
"316561615879993456390283050973363039134",
"60514240412469533972913727466118101420",
"297559882044707025863690354315205989482"
]
},
"target": {
"file": "net/ceph/mon_client.c"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@20cf67dcb7db842f941eff1af6ee5e9dc41796d7",
"id": "CVE-2024-42232-eee25595"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"169584702279682524563917184423514721030",
"71087387267687637643731295453117568874",
"39670781859956872858406102538225166685",
"26307991143692803026588163230133146815",
"54969059580525060424990163339726744658",
"52407694445482389239303823098907231636",
"302439920907010895457930437496718091611",
"11232637764709653059865479373686017537",
"82561163208885199497412567751007014043",
"323031361195031267460039519394641615449",
"226191764916406091661884830137188347300",
"304069801657105906744000750077144321506",
"312499255660910590788382089600333900237",
"111486169807242549370725069003465958961",
"36778853295281570416879496219020074075",
"49790940796228197419672597576114378746",
"96308326152686475496289421174771427173",
"220060524447845941323372784775888320959",
"294140909990819676340129133965065546465",
"316561615879993456390283050973363039134",
"60514240412469533972913727466118101420",
"297559882044707025863690354315205989482"
]
},
"target": {
"file": "net/ceph/mon_client.c"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@63e5d035e3a7ab7412a008f202633c5e6a0a28ea",
"id": "CVE-2024-42232-f105dc59"
},
{
"digest": {
"length": 927.0,
"function_hash": "33097678824327037917235092340764833582"
},
"target": {
"function": "delayed_work",
"file": "net/ceph/mon_client.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1177afeca833174ba83504688eec898c6214f4bf",
"id": "CVE-2024-42232-f3b90be5"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"169584702279682524563917184423514721030",
"71087387267687637643731295453117568874",
"39670781859956872858406102538225166685",
"26307991143692803026588163230133146815",
"54969059580525060424990163339726744658",
"52407694445482389239303823098907231636",
"302439920907010895457930437496718091611",
"11232637764709653059865479373686017537",
"82561163208885199497412567751007014043",
"323031361195031267460039519394641615449",
"226191764916406091661884830137188347300",
"304069801657105906744000750077144321506",
"312499255660910590788382089600333900237",
"111486169807242549370725069003465958961",
"36778853295281570416879496219020074075",
"49790940796228197419672597576114378746",
"96308326152686475496289421174771427173",
"220060524447845941323372784775888320959",
"294140909990819676340129133965065546465",
"316561615879993456390283050973363039134",
"60514240412469533972913727466118101420",
"297559882044707025863690354315205989482"
]
},
"target": {
"file": "net/ceph/mon_client.c"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@69c7b2fe4c9cc1d3b1186d1c5606627ecf0de883",
"id": "CVE-2024-42232-f45d9f6c"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"169584702279682524563917184423514721030",
"71087387267687637643731295453117568874",
"39670781859956872858406102538225166685",
"26307991143692803026588163230133146815",
"54969059580525060424990163339726744658",
"52407694445482389239303823098907231636",
"302439920907010895457930437496718091611",
"11232637764709653059865479373686017537",
"82561163208885199497412567751007014043",
"323031361195031267460039519394641615449",
"226191764916406091661884830137188347300",
"304069801657105906744000750077144321506",
"312499255660910590788382089600333900237",
"111486169807242549370725069003465958961",
"36778853295281570416879496219020074075",
"49790940796228197419672597576114378746",
"96308326152686475496289421174771427173",
"220060524447845941323372784775888320959",
"294140909990819676340129133965065546465",
"316561615879993456390283050973363039134",
"60514240412469533972913727466118101420",
"297559882044707025863690354315205989482"
]
},
"target": {
"file": "net/ceph/mon_client.c"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2d33654d40a05afd91ab24c9a73ab512a0670a9a",
"id": "CVE-2024-42232-f5faa6e3"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"169584702279682524563917184423514721030",
"71087387267687637643731295453117568874",
"39670781859956872858406102538225166685",
"26307991143692803026588163230133146815",
"54969059580525060424990163339726744658",
"52407694445482389239303823098907231636",
"302439920907010895457930437496718091611",
"11232637764709653059865479373686017537",
"82561163208885199497412567751007014043",
"323031361195031267460039519394641615449",
"226191764916406091661884830137188347300",
"304069801657105906744000750077144321506",
"312499255660910590788382089600333900237",
"111486169807242549370725069003465958961",
"36778853295281570416879496219020074075",
"49790940796228197419672597576114378746",
"96308326152686475496289421174771427173",
"220060524447845941323372784775888320959",
"294140909990819676340129133965065546465",
"316561615879993456390283050973363039134",
"60514240412469533972913727466118101420",
"297559882044707025863690354315205989482"
]
},
"target": {
"file": "net/ceph/mon_client.c"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@33d38c5da17f8db2d80e811b7829d2822c10625e",
"id": "CVE-2024-42232-fcbc2d3e"
}
]