linux-cve-announce - CVE-2024-26689: ceph: prevent use-after-free in encode_cap

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2024040336-CVE-2024-26689-990b@gregkh>
Date: Wed,  3 Apr 2024 16:55:40 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2024-26689: ceph: prevent use-after-free in encode_cap_msg()

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

ceph: prevent use-after-free in encode_cap_msg()

In fs/ceph/caps.c, in encode_cap_msg(), "use after free" error was
caught by KASAN at this line - 'ceph_buffer_get(arg->xattr_buf);'. This
implies before the refcount could be increment here, it was freed.

In same file, in "handle_cap_grant()" refcount is decremented by this
line - 'ceph_buffer_put(ci->i_xattrs.blob);'. It appears that a race
occurred and resource was freed by the latter line before the former
line could increment it.

encode_cap_msg() is called by __send_cap() and __send_cap() is called by
ceph_check_caps() after calling __prep_cap(). __prep_cap() is where
arg->xattr_buf is assigned to ci->i_xattrs.blob. This is the spot where
the refcount must be increased to prevent "use after free" error.

The Linux kernel CVE team has assigned CVE-2024-26689 to this issue.

Affected and fixed versions
===========================

	Fixed in 5.10.210 with commit 8180d0c27b93
	Fixed in 5.15.149 with commit 70e329b44076
	Fixed in 6.1.79 with commit f3f98d7d84b3
	Fixed in 6.6.18 with commit ae20db45e482
	Fixed in 6.7.6 with commit 7958c1bf5b03
	Fixed in 6.8 with commit cda4672da1c2

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2024-26689
will be updated if fixes are backported, please check that for the most
up to date information about this issue.

Affected files
==============

The file(s) affected by this issue are:
	fs/ceph/caps.c

Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/8180d0c27b93a6eb60da1b08ea079e3926328214
	https://git.kernel.org/stable/c/70e329b440762390258a6fe8c0de93c9fdd56c77
	https://git.kernel.org/stable/c/f3f98d7d84b31828004545e29fd7262b9f444139
	https://git.kernel.org/stable/c/ae20db45e482303a20e56f2db667a9d9c54ac7e7
	https://git.kernel.org/stable/c/7958c1bf5b03c6f1f58e724dbdec93f8f60b96fc
	https://git.kernel.org/stable/c/cda4672da1c26835dcbd7aec2bfed954eda9b5ef