Description
In the Linux kernel, the following vulnerability has been resolved: libceph: remove debugfs files before client teardown ceph_destroy_client() tears down the monitor client before removing the per-client debugfs files. A concurrent read of the monmap debugfs file can enter monmap_show() after ceph_monc_stop() has freed monc->monmap, triggering a use-after-free. Remove the debugfs files before stopping the OSD and monitor clients. debugfs_remove() drains active handlers and prevents new accesses, so the debugfs callbacks can no longer race the rest of client teardown.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
76aa844d5b2fb8c839180d3f5874e333b297e5fd to < ac78549d186090ee7125d28c3a8c376573b36194affected76aa844d5b2fb8c839180d3f5874e333b297e5fd to < 463a264e9094384112a5c8b46f0a9ddaf8566904affected76aa844d5b2fb8c839180d3f5874e333b297e5fd to < fe46b7e06f14f6f94766832df309b249cb689d27affected76aa844d5b2fb8c839180d3f5874e333b297e5fd to < fc1010e7e0204ece6cc0f9af4f473e9553535eabaffected76aa844d5b2fb8c839180d3f5874e333b297e5fd to < d3dc8889d39a676bf840132bd5c5c48cb0daba23affected76aa844d5b2fb8c839180d3f5874e333b297e5fd to < 8f5a3abc54ba24dbceb14cc3a719908c4f688091affected76aa844d5b2fb8c839180d3f5874e333b297e5fd to < b9fedda2f628e030384228de0dafc574b7fb0c2faffected76aa844d5b2fb8c839180d3f5874e333b297e5fd to < e4c804726c4afce3ba648b982d564f6af2cfa328affected
Linux Linux
Default version status: affected
2.6.34affected0 to < 2.6.34unaffected5.10.265 to ≤ 5.10.*unaffected5.15.216 to ≤ 5.15.*unaffected6.1.183 to ≤ 6.1.*unaffected6.6.148 to ≤ 6.6.*unaffected6.12.101 to ≤ 6.12.*unaffected6.18.42 to ≤ 6.18.*unaffected7.1.6 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/ac78549d186090ee7125d28c3a8c376573b36194 ↗
- https://git.kernel.org/stable/c/463a264e9094384112a5c8b46f0a9ddaf8566904 ↗
- https://git.kernel.org/stable/c/fe46b7e06f14f6f94766832df309b249cb689d27 ↗
- https://git.kernel.org/stable/c/fc1010e7e0204ece6cc0f9af4f473e9553535eab ↗
- https://git.kernel.org/stable/c/d3dc8889d39a676bf840132bd5c5c48cb0daba23 ↗
- https://git.kernel.org/stable/c/8f5a3abc54ba24dbceb14cc3a719908c4f688091 ↗
- https://git.kernel.org/stable/c/b9fedda2f628e030384228de0dafc574b7fb0c2f ↗
- https://git.kernel.org/stable/c/e4c804726c4afce3ba648b982d564f6af2cfa328 ↗