linux-cve-announce - CVE-2024-42232: libceph: fix race between delayed_work() and ceph_monc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2024080737-CVE-2024-42232-8ab2@gregkh>
Date: Wed,  7 Aug 2024 17:14:38 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2024-42232: libceph: fix race between delayed_work() and ceph_monc_stop()

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

libceph: fix race between delayed_work() and ceph_monc_stop()

The way the delayed work is handled in ceph_monc_stop() is prone to
races with mon_fault() and possibly also finish_hunting().  Both of
these can requeue the delayed work which wouldn't be canceled by any of
the following code in case that happens after cancel_delayed_work_sync()
runs -- __close_session() doesn't mess with the delayed work in order
to avoid interfering with the hunting interval logic.  This part was
missed in commit b5d91704f53e ("libceph: behave in mon_fault() if
cur_mon < 0") and use-after-free can still ensue on monc and objects
that hang off of it, with monc->auth and monc->monmap being
particularly susceptible to quickly being reused.

To fix this:

- clear monc->cur_mon and monc->hunting as part of closing the session
  in ceph_monc_stop()
- bail from delayed_work() if monc->cur_mon is cleared, similar to how
  it's done in mon_fault() and finish_hunting() (based on monc->hunting)
- call cancel_delayed_work_sync() after the session is closed

The Linux kernel CVE team has assigned CVE-2024-42232 to this issue.


Affected and fixed versions
===========================

	Fixed in 4.19.318 with commit 1177afeca833
	Fixed in 5.4.280 with commit 63e5d035e3a7
	Fixed in 5.10.222 with commit 34b76d1922e4
	Fixed in 5.15.163 with commit 20cf67dcb7db
	Fixed in 6.1.100 with commit 2d33654d40a0
	Fixed in 6.6.41 with commit 9525af1f58f6
	Fixed in 6.9.10 with commit 33d38c5da17f
	Fixed in 6.10 with commit 69c7b2fe4c9c

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2024-42232
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/ceph/mon_client.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/1177afeca833174ba83504688eec898c6214f4bf
	https://git.kernel.org/stable/c/63e5d035e3a7ab7412a008f202633c5e6a0a28ea
	https://git.kernel.org/stable/c/34b76d1922e41da1fa73d43b764cddd82ac9733c
	https://git.kernel.org/stable/c/20cf67dcb7db842f941eff1af6ee5e9dc41796d7
	https://git.kernel.org/stable/c/2d33654d40a05afd91ab24c9a73ab512a0670a9a
	https://git.kernel.org/stable/c/9525af1f58f67df387768770fcf6d6a8f23aee3d
	https://git.kernel.org/stable/c/33d38c5da17f8db2d80e811b7829d2822c10625e
	https://git.kernel.org/stable/c/69c7b2fe4c9cc1d3b1186d1c5606627ecf0de883