Linux kernel ceph client: use-after-free when trimming caps concurrently with cap removal

Impact

A race between cap trimming and concurrent cap removal left ceph_iterate_session_caps() using freed cap memory in its callbacks, crashing the client. This hits GPU nodes that mount CephFS in-kernel for datasets, checkpoints or shared home directories: the fault is on the compute node, so a trim storm under memory pressure takes down a node running tenant jobs rather than the storage cluster. The record describes a timing-dependent use-after-free fixed by re-checking cap existence under i_ceph_lock, with no evidence of a controllable exploit primitive - read it as availability risk on mounted clients.

Who can reach it

Local, and not directly attacker-driven: triggered by kernel cap trimming racing MDS-driven cap removal on a node with a CephFS mount. No tenant action is required, and no authentication boundary is crossed.

What to do

Apply the stable kernel update carrying the fix (commits in the record) and reboot each affected node; drain GPU nodes first, since an in-kernel CephFS mount cannot be replaced without unmounting. No mitigation short of the patch other than avoiding kernel CephFS mounts on compute nodes.

References

Related entries

• Palo Alto PAN-OS: Management web interface authentication bypassCVE-2024-0012 · Palo Alto PAN-OSCritical
• OpenVPN (tap-windows6): Unchecked write sizeCVE-2024-1305 · OpenVPN (tap-windows6)Critical
• Fortinet FortiOS: SSL-VPN out-of-bounds writeCVE-2024-21762 · Fortinet FortiOSCritical
• NetApp ONTAP Select Deploy administration utility (hard-coded credentials): Baked-in credentials let an attacker readCVE-2024-21990 · NetApp ONTAP Select Deploy administration utility (hard-coded credentials)Critical
• HPE Cray Parallel Application Launch Service (PALS) authentication bypass: Authentication bypass in the serviceCVE-2024-22441 · HPE Cray Parallel Application Launch Service (PALS) authentication bypassCritical
• Jenkins: CLI parser expands `@file` into argument contentsCVE-2024-23897 · JenkinsCritical