Linux libceph: stale authorizer buffer pointer after ticket refresh causes a use-after-free on msgr1 reconnect

Impact

ceph_x_create_authorizer() caches the authorizer buffer pointer and length in struct ceph_auth_handshake, but when a newer service ticket arrives and the rebuilt authorizer no longer fits, the old ceph_buffer is freed while auth->authorizer_buf still points at it. A later msgr1 reconnect queues that freed pointer and the kernel hits a slab use-after-free inside _copy_from_iter() as tcp_sendmsg() copies it. The realistic outcomes are a KASAN-detected crash of the node or freed slab contents being copied onto the wire toward the Ceph cluster; on a GPU node with kernel CephFS or RBD mounts that means an unplanned loss of the node and any resident job. The trigger is ordinary cluster behaviour - ticket rotation followed by a reconnect - rather than something a tenant on the node can steer, so treat this as a stability and information-exposure bug and not as the remote-root the 9.8 AV:N score implies.

Who can reach it

No tenant path. Triggered by Ceph service ticket rotation plus a msgr1 reconnect; influencing the timing requires control of the Ceph monitors or the ability to disrupt the storage network. Clients using msgr2 exclusively are not on the described reconnect path.

What to do

Update to a stable kernel carrying the fix (five backport commits are linked on the record) and reboot each node with a kernel Ceph mount - a mounted client cannot be reloaded in place, so this is a drain and reboot, best batched with the other libceph fixes from the same day. No configuration change avoids it, though clusters that have moved fully to msgr2 are less likely to hit the reconnect path in the meantime.

References