In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ceph: fix UAF in check_new_map() on session freed during unlock<\/p>\n
check_new_map() iterates mdsc->sessions[] and for each active session
\ndrops mdsc->mutex to perform per-session operations. The forced-close
\npath (rank removed from map) correctly takes a reference on s via
\nceph_get_mds_session() before releasing mdsc->mutex, but three other
\npaths do not:<\/p>\n
Path A (address changed): mutex_unlock \u2192 mutex_lock(&s->s_mutex)
\n Path B (reconnect): mutex_unlock \u2192 send_mds_reconnect(mdsc, s)
\n Path C (active transition): mutex_unlock \u2192 mutex_lock(&s->s_mutex)<\/p>\n
Without the extra reference, another thread can acquire mdsc->mutex
\nduring the unlock window, call __unregister_session() which drops the
\nlast reference on s, and free it. The original thread then accesses
\nfreed memory via s->s_mutex.<\/p>\n
Fix by adding ceph_get_mds_session(s) before each mutex_unlock and
\nceph_put_mds_session(s) after the corresponding mutex_lock, matching
\nthe pattern already used in the forced-close path.<\/p>\n
Race timeline (Path A):<\/p>\n
Thread A (check_new_map) Thread B (another map update
\n holds mdsc->mutex or session teardown)
\n ————————– ————————–
\n s = mdsc->sessions[i]
\n (refcount == 1, held only by
\n sessions[] array)<\/p>\n
mutex_unlock(&mdsc->mutex)
\n —> acquires mdsc->mutex
\n __unregister_session(mdsc, s)
\n sessions[i] = NULL
\n ceph_put_mds_session(s)
\n refcount: 1 -> 0
\n kfree(s) s_mutex)
\n UAF on freed s->s_mutex<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ceph: fix UAF in check_new_map() on session freed during unlock<\/p>\n
check_new_map() iterates mdsc->sessions[] and for each active sess<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21576","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21576","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21576"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21576"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21576"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}