CVE-2024-42232

The way the delayed work is handled in cephmoncstop() is prone to races with monfault() and possibly also finishhunting(). Both of these can requeue the delayed work which wouldn't be canceled by any of the following code in case that happens after canceldelayedwork_sync() runs -- _closesession() doesn't mess with the delayed work in order to avoid interfering with the hunting interval logic. This part was missed in commit b5d91704f53e ("libceph: behave in monfault() if curmon < 0") and use-after-free can still ensue on monc and objects that hang off of it, with monc->auth and monc->monmap being particularly susceptible to quickly being reused.

To fix this:

clear monc->curmon and monc->hunting as part of closing the session in cephmonc_stop()
bail from delayedwork() if monc->curmon is cleared, similar to how it's done in monfault() and finishhunting() (based on monc->hunting)
call canceldelayedwork_sync() after the session is closed

Database specific

{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/42xxx/CVE-2024-42232.json"
}

References

Affected packages

Linux / Kernel

Package

Name: Kernel

Affected ranges

Type: ECOSYSTEM
Events: Introduced

4.6.0

Fixed

4.19.318

Type: ECOSYSTEM
Events: Introduced

4.20.0

Fixed

5.4.280

Type: ECOSYSTEM
Events: Introduced

5.5.0

Fixed

5.10.222

Type: ECOSYSTEM
Events: Introduced

5.11.0

Fixed

5.15.163

Type: ECOSYSTEM
Events: Introduced

5.16.0

Fixed

6.1.100

Type: ECOSYSTEM
Events: Introduced

6.2.0

Fixed

6.6.41

Type: ECOSYSTEM
Events: Introduced

6.7.0

Fixed

6.9.10

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-42232.json"