CVE-2024-42232

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

libceph: fix race between delayed_work() and ceph_monc_stop()

The way the delayed work is handled in ceph_monc_stop() is prone to

races with mon_fault() and possibly also finish_hunting(). Both of

these can requeue the delayed work which wouldn't be canceled by any of

the following code in case that happens after cancel_delayed_work_sync()

runs -- __close_session() doesn't mess with the delayed work in order

to avoid interfering with the hunting interval logic. This part was

missed in commit b5d91704f53e ("libceph: behave in mon_fault() if

cur_mon < 0") and use-after-free can still ensue on monc and objects

that hang off of it, with monc->auth and monc->monmap being

particularly susceptible to quickly being reused.

To fix this:

- clear monc->cur_mon and monc->hunting as part of closing the session

in ceph_monc_stop()

- bail from delayed_work() if monc->cur_mon is cleared, similar to how

it's done in mon_fault

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References