CVE-2024-26689: ceph: prevent use-after-free in encode_cap_msg()
In the Linux kernel, the following vulnerability has been resolved:
ceph: prevent use-after-free in encodecapmsg()
In fs/ceph/caps.c, in encodecapmsg(), "use after free" error was caught by KASAN at this line - 'cephbufferget(arg->xattrbuf);'. This implies before the refcount could be increment here, it was freed.
In same file, in "handlecapgrant()" refcount is decremented by this line - 'cephbufferput(ci->ixattrs.blob);'. It appears that a race occurred and resource was freed by the latter line before the former line could increment it.
encodecapmsg() is called by sendcap() and sendcap() is called by cephcheckcaps() after calling prepcap(). prepcap() is where arg->xattrbuf is assigned to ci->ixattrs.blob. This is the spot where the refcount must be increased to prevent "use after free" error.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.27-1 - Configuration
In fs/ceph/caps.c, adjust the refcount/lifetime handling so the buffer assigned in __prep_cap() to ci->i_xattrs.blob is refcount-incremented (as at 'ceph_buffer_get(arg->xattr_buf);') before any path can execute 'ceph_buffer_put(ci->i_xattrs.blob);' that may free it; this prevents the KASAN-detected use-after-free in encode_cap_msg().
Linux kernel (Ceph filesystem client) encode_cap_msg() reference counting / lifetime of arg->xattr_buf = ceph_buffer_get() must occur after __prep_cap() assigns arg->xattr_buf to ci->i_xattrs.blob (and before any corresponding ceph_buffer_put(ci->i_xattrs.blob) that can free the buffer)
Event History
Frequently Asked Questions
What is the severity of CVE-2024-26689?
CVE-2024-26689 is classified as a high severity vulnerability due to its potential for causing use-after-free errors in the Linux kernel.
How do I fix CVE-2024-26689?
To fix CVE-2024-26689, upgrade to the patched versions of the Linux kernel, specifically versions 5.10.223-1, 5.10.226-1, 6.1.123-1, 6.1.119-1, 6.12.10-1, or 6.12.11-1.
Which systems are affected by CVE-2024-26689?
CVE-2024-26689 affects multiple versions of the Linux kernel including those below 5.10.223 and certain ranges between 5.11 and 6.8.
How can I verify if I'm vulnerable to CVE-2024-26689?
You can verify vulnerability to CVE-2024-26689 by checking your Linux kernel version against the specified affected versions.
What are the consequences of CVE-2024-26689?
The consequences of CVE-2024-26689 can lead to memory corruption and could potentially allow attackers to execute arbitrary code.