CVE-2024-42232: libceph: fix race between delayed_work() and ceph_monc_stop()
In the Linux kernel, the following vulnerability has been resolved:
libceph: fix race between delayedwork() and cephmoncstop()
The way the delayed work is handled in cephmoncstop() is prone to races with monfault() and possibly also finishhunting(). Both of these can requeue the delayed work which wouldn't be canceled by any of the following code in case that happens after canceldelayedworksync() runs -- closesession() doesn't mess with the delayed work in order to avoid interfering with the hunting interval logic. This part was missed in commit b5d91704f53e ("libceph: behave in monfault() if curmon < 0") and use-after-free can still ensue on monc and objects that hang off of it, with monc->auth and monc->monmap being particularly susceptible to quickly being reused.
To fix this:
- clear monc->curmon and monc->hunting as part of closing the session in cephmoncstop() - bail from delayedwork() if monc->curmon is cleared, similar to how it's done in monfault() and finishhunting() (based on monc->hunting) - call canceldelayedworksync() after the session is closed
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1 - Configuration
In ceph_monc_stop(), implement the described fix: (1) clear monc->cur_mon and monc->hunting during session close, (2) in delayed_work(), bail out if monc->cur_mon is cleared (similar to mon_fault() / finish_hunting()), and (3) call cancel_delayed_work_sync() after the session is closed to prevent delayed work from requeuing after cancellation.
Linux kernel (libceph) ceph_monc_stop() delayed work shutdown logic = clear monc->cur_mon and monc->hunting as part of closing the session; bail from delayed_work() when monc->cur_mon is cleared; call cancel_delayed_work_sync() after the session is closed
Event History
Frequently Asked Questions
What is the severity of CVE-2024-42232?
CVE-2024-42232 has a high severity due to its potential impact on the stability of the Linux kernel.
How do I fix CVE-2024-42232?
To fix CVE-2024-42232, upgrade the Linux kernel to a version that is patched against this vulnerability.
Which versions of the Linux kernel are affected by CVE-2024-42232?
CVE-2024-42232 affects multiple Linux kernel versions including those between 4.20 and 5.4.280, and others up to 6.9.10.
What components are involved in the CVE-2024-42232 vulnerability?
The CVE-2024-42232 vulnerability involves a race condition between delayed work and ceph_monc_stop() in the Linux kernel.
Is there an exploit available for CVE-2024-42232?
As of now, there is no public proof of concept or exploit for CVE-2024-42232, but it is recommended to apply mitigations.