Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2024-42232— libceph: fix race between delayed_work() and ceph_monc_stop()

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel 存在安全漏洞，该漏洞源于 libceph 模块在ceph_monc_stop中处理延迟工作的方式存在竞争条件，可能导致monc和挂靠在其上的对象出现释放后重用问题。

CVSS 9.8 · Critical EPSS 0.76% · P54

Possible ATT&CK Techniques 1 AI

T1068 · Exploitation for Privilege Escalation

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 0e04dc26cc594d31ee6b1382b452b6bc83b57937< 1177afeca833174ba83504688eec898c6214f4bf affected
0e04dc26cc594d31ee6b1382b452b6bc83b57937< 63e5d035e3a7ab7412a008f202633c5e6a0a28ea affected
0e04dc26cc594d31ee6b1382b452b6bc83b57937< 34b76d1922e41da1fa73d43b764cddd82ac9733c affected
0e04dc26cc594d31ee6b1382b452b6bc83b57937< 20cf67dcb7db842f941eff1af6ee5e9dc41796d7 affected
0e04dc26cc594d31ee6b1382b452b6bc83b57937< 2d33654d40a05afd91ab24c9a73ab512a0670a9a affected
0e04dc26cc594d31ee6b1382b452b6bc83b57937< 9525af1f58f67df387768770fcf6d6a8f23aee3d affected
0e04dc26cc594d31ee6b1382b452b6bc83b57937< 33d38c5da17f8db2d80e811b7829d2822c10625e affected
0e04dc26cc594d31ee6b1382b452b6bc83b57937< 69c7b2fe4c9cc1d3b1186d1c5606627ecf0de883 affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2024-42232

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
libceph: fix race between delayed_work() and ceph_monc_stop()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: libceph: fix race between delayed_work() and ceph_monc_stop() The way the delayed work is handled in ceph_monc_stop() is prone to races with mon_fault() and possibly also finish_hunting(). Both of these can requeue the delayed work which wouldn't be canceled by any of the following code in case that happens after cancel_delayed_work_sync() runs -- __close_session() doesn't mess with the delayed work in order to avoid interfering with the hunting interval logic. This part was missed in commit b5d91704f53e ("libceph: behave in mon_fault() if cur_mon < 0") and use-after-free can still ensue on monc and objects that hang off of it, with monc->auth and monc->monmap being particularly susceptible to quickly being reused. To fix this: - clear monc->cur_mon and monc->hunting as part of closing the session in ceph_monc_stop() - bail from delayed_work() if monc->cur_mon is cleared, similar to how it's done in mon_fault() and finish_hunting() (based on monc->hunting) - call cancel_delayed_work_sync() after the session is closed
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel 存在安全漏洞，该漏洞源于 libceph 模块在ceph_monc_stop中处理延迟工作的方式存在竞争条件，可能导致monc和挂靠在其上的对象出现释放后重用问题。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 0e04dc26cc594d31ee6b1382b452b6bc83b57937 ~ 1177afeca833174ba83504688eec898c6214f4bf -
Linux Linux 4.6 -

II. Public POCs for CVE-2024-42232

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2024-42232

请登录查看更多情报信息。

Patches & Fixes for CVE-2024-42232 (2)

Same Patch Batch · Linux · 2024-08-07 · 19 CVEs total

CVE-2024-42234 7.8 HIGH mm: fix crashes from deferred split racing folio migration
CVE-2024-42249 7.8 HIGH spi: don't unoptimize message in spi_async()
CVE-2024-42233 7.8 HIGH filemap: replace pte_offset_map() with pte_offset_map_nolock()
CVE-2024-42235 7.8 HIGH s390/mm: Add NULL pointer check to crst_table_free() base_crst_free()
CVE-2024-42236 7.8 HIGH usb: gadget: configfs: Prevent OOB read/write in usb_string_copy()
CVE-2024-42250 7.8 HIGH cachefiles: add missing lock protection when polling
CVE-2024-42247 7.5 HIGH wireguard: allowedips: avoid unaligned 64-bit memory accesses
CVE-2024-42242 mmc: sdhci: Fix max_seg_size for 64KiB PAGE_SIZE
CVE-2024-42237 firmware: cs_dsp: Validate payload length before processing block
CVE-2024-42238 firmware: cs_dsp: Return error if block header overflows file
CVE-2024-42239 bpf: Fail bpf_timer_cancel when callback is being cancelled
CVE-2024-42240 x86/bhi: Avoid warning in #DB handler due to BHI mitigation
CVE-2024-42241 mm/shmem: disable PMD-sized page cache if needed
CVE-2024-42244 USB: serial: mos7840: fix crash on resume
CVE-2024-42243 mm/filemap: make MAX_PAGECACHE_ORDER acceptable to xarray
CVE-2024-42245 Revert "sched/fair: Make sure to try to detach at least one movable task"
CVE-2024-42246 net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket
CVE-2024-42248 tty: serial: ma35d1: Add a NULL check for of_node

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2024-42232

No comments yet

Leave a comment