In the Linux kernel, the following vulnerability has been resolved:
ceph: fix potential use-after-free bug when trimming caps
When trimming the caps and just after the 'session->s_cap_lock' is
released in ceph_iterate_session_caps() the cap maybe removed by
another thread, and when using the stale cap memory in the callbacks
it will trigger use-after-free crash.
We need to check the existence of the cap just after the 'ci->i_ceph_lock'
being acquired. And do nothing if it's already removed.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
High
Complete denial of service
CVSS Vector v3.1
References 4
https://git.kernel.org/stable/c/2b2515b8095cf2149bef44383a99d5b5677f1831
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/448875a73e16ba7d81dec9274ce9d33a12d092fb
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/aaf67de78807c59c35bafb5003d4fb457c764800
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/ae6e935618d99cdba11eab4714092e7e5f13cf7e
416baaa9-dc9f-4396-8d5f-8c081fb06d67