libceph Debugfs Use-After-Free in Linux Kernel

Executive Summary

This is a use-after-free vulnerability in the Linux kernel's Ceph client implementation. It occurs when ceph_destroy_client() removes the monitor client before cleaning up debugfs files. A concurrent read of the monmap debugfs file can trigger a use-after-free because monmap_show() tries to access monc->monmap after it has been freed by ceph_monc_stop().

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is specific to the Linux kernel's Ceph client implementation and involves a use-after-free condition in debugfs file handling. Detection requires checking kernel logs for related errors or enabling debugfs monitoring. Commands like dmesg | grep ceph or checking /sys/kernel/debug/ceph for debugfs entries may help identify issues.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow an attacker with local access to cause a system crash or potentially execute arbitrary code with kernel privileges. It may lead to denial-of-service conditions or unauthorized access to sensitive system data.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Linux kernel to a patched version where the fix has been applied. The vulnerability is resolved by removing debugfs files before client teardown, so ensure your kernel includes this change. Monitor kernel updates from your distribution vendor.

Useful 0 Not Useful 0