CVE-2024-42232

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-42232", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-07-30T07:40:12.251Z", "datePublished": "2024-08-07T15:14:23.074Z", "dateUpdated": "2026-08-05T11:35:57.190Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:35:57.190Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: fix race between delayed_work() and ceph_monc_stop()\n\nThe way the delayed work is handled in ceph_monc_stop() is prone to\nraces with mon_fault() and possibly also finish_hunting(). Both of\nthese can requeue the delayed work which wouldn't be canceled by any of\nthe following code in case that happens after cancel_delayed_work_sync()\nruns -- __close_session() doesn't mess with the delayed work in order\nto avoid interfering with the hunting interval logic. This part was\nmissed in commit b5d91704f53e (\"libceph: behave in mon_fault() if\ncur_mon < 0\") and use-after-free can still ensue on monc and objects\nthat hang off of it, with monc->auth and monc->monmap being\nparticularly susceptible to quickly being reused.\n\nTo fix this:\n\n- clear monc->cur_mon and monc->hunting as part of closing the session\n in ceph_monc_stop()\n- bail from delayed_work() if monc->cur_mon is cleared, similar to how\n it's done in mon_fault() and finish_hunting() (based on monc->hunting)\n- call cancel_delayed_work_sync() after the session is closed"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - Both paths that re-arm the delayed work \u2014 `mon_fault()` via `con_fault()` on any socket error/RST, and `finish_hunting()` on a monitor auth reply \u2014 are driven entirely by the remote Ceph monitor over TCP, and the attacker can also force the teardown by making the mon session fail so the mount times out into `destroy_fs_client()`. No local access to the target is needed for the attacker's contribution.\nAC:L - The attacker controls both sides of the race: it drives connection faults at an arbitrary rate and induces the `ceph_monc_stop()` teardown by refusing/resetting the session, and the window is amplified because `mon_fault()` holds `monc->mutex` while `ceph_monc_stop()` blocks on it after the cancel has already run. The attempt is free and infinitely repeatable across mount/unmount cycles.\nPR:N - The attacker is an unauthenticated remote peer \u2014 `con_fault()` fires on socket errors before any cephx authentication succeeds, and the monitor is the entity the client authenticates *to*, so no credentials on the victim host are required.\nUI:N - No victim action is needed beyond normal, automated cluster operation \u2014 ceph-csi/Kubernetes, autofs and systemd mount units perform cephfs/rbd mount, unmount and retry cycles continuously without human involvement, and each failed or torn-down session is an exploitation attempt.\nS:U - The use-after-free corrupts kernel heap memory and executes within the kernel's own security authority, with no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - Use-after-free on `ceph_client`/`ceph_mon_client`, `ceph_auth_client` and `ceph_monmap`, with `pick_new_mon()` indexing `monc->monmap->mon_inst[monc->cur_mon]` using a base pointer and index both read from freed, attacker-groomable memory \u2014 an out-of-bounds read primitive usable for kernel memory disclosure.\nI:H - `ceph_auth_is_authenticated()` performs `ac->ops->is_authenticated(ac)`, an indirect call through a function pointer read from a freed slab object the remote monitor can reclaim during the multi-second delay, giving control-flow hijack; `mutex_lock()` and `mod_delayed_work()` additionally write timer/work state into the freed-and-reused allocation.\nA:H - The delayed work executing on freed memory reliably oopses, and `BUG_ON(monc->monmap->num_mon < 1)` in `pick_new_mon()` panics the kernel outright when the freed monmap is reused."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ceph/mon_client.c"], "versions": [{"version": "0e04dc26cc594d31ee6b1382b452b6bc83b57937", "lessThan": "1177afeca833174ba83504688eec898c6214f4bf", "status": "affected", "versionType": "git"}, {"version": "0e04dc26cc594d31ee6b1382b452b6bc83b57937", "lessThan": "63e5d035e3a7ab7412a008f202633c5e6a0a28ea", "status": "affected", "versionType": "git"}, {"version": "0e04dc26cc594d31ee6b1382b452b6bc83b57937", "lessThan": "34b76d1922e41da1fa73d43b764cddd82ac9733c", "status": "affected", "versionType": "git"}, {"version": "0e04dc26cc594d31ee6b1382b452b6bc83b57937", "lessThan": "20cf67dcb7db842f941eff1af6ee5e9dc41796d7", "status": "affected", "versionType": "git"}, {"version": "0e04dc26cc594d31ee6b1382b452b6bc83b57937", "lessThan": "2d33654d40a05afd91ab24c9a73ab512a0670a9a", "status": "affected", "versionType": "git"}, {"version": "0e04dc26cc594d31ee6b1382b452b6bc83b57937", "lessThan": "9525af1f58f67df387768770fcf6d6a8f23aee3d", "status": "affected", "versionType": "git"}, {"version": "0e04dc26cc594d31ee6b1382b452b6bc83b57937", "lessThan": "33d38c5da17f8db2d80e811b7829d2822c10625e", "status": "affected", "versionType": "git"}, {"version": "0e04dc26cc594d31ee6b1382b452b6bc83b57937", "lessThan": "69c7b2fe4c9cc1d3b1186d1c5606627ecf0de883", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ceph/mon_client.c"], "versions": [{"version": "4.6", "status": "affected"}, {"version": "0", "lessThan": "4.6", "status": "unaffected", "versionType": "semver"}, {"version": "4.19.318", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.280", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.222", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.163", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.100", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.41", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.9.10", "lessThanOrEqual": "6.9.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.10", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.6", "versionEndExcluding": "4.19.318"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.6", "versionEndExcluding": "5.4.280"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.6", "versionEndExcluding": "5.10.222"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.6", "versionEndExcluding": "5.15.163"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.6", "versionEndExcluding": "6.1.100"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.6", "versionEndExcluding": "6.6.41"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.6", "versionEndExcluding": "6.9.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.6", "versionEndExcluding": "6.10"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/1177afeca833174ba83504688eec898c6214f4bf"}, {"url": "https://git.kernel.org/stable/c/63e5d035e3a7ab7412a008f202633c5e6a0a28ea"}, {"url": "https://git.kernel.org/stable/c/34b76d1922e41da1fa73d43b764cddd82ac9733c"}, {"url": "https://git.kernel.org/stable/c/20cf67dcb7db842f941eff1af6ee5e9dc41796d7"}, {"url": "https://git.kernel.org/stable/c/2d33654d40a05afd91ab24c9a73ab512a0670a9a"}, {"url": "https://git.kernel.org/stable/c/9525af1f58f67df387768770fcf6d6a8f23aee3d"}, {"url": "https://git.kernel.org/stable/c/33d38c5da17f8db2d80e811b7829d2822c10625e"}, {"url": "https://git.kernel.org/stable/c/69c7b2fe4c9cc1d3b1186d1c5606627ecf0de883"}], "title": "libceph: fix race between delayed_work() and ceph_monc_stop()", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-42232", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T16:14:16.994766Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:34:32.623Z"}}, {"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T22:02:36.305Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T22:02:36.305Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-42232", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T16:14:16.994766Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T12:42:24.328Z"}}], "cna": {"title": "libceph: fix race between delayed_work() and ceph_monc_stop()", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "0e04dc26cc594d31ee6b1382b452b6bc83b57937", "lessThan": "1177afeca833174ba83504688eec898c6214f4bf", "versionType": "git"}, {"status": "affected", "version": "0e04dc26cc594d31ee6b1382b452b6bc83b57937", "lessThan": "63e5d035e3a7ab7412a008f202633c5e6a0a28ea", "versionType": "git"}, {"status": "affected", "version": "0e04dc26cc594d31ee6b1382b452b6bc83b57937", "lessThan": "34b76d1922e41da1fa73d43b764cddd82ac9733c", "versionType": "git"}, {"status": "affected", "version": "0e04dc26cc594d31ee6b1382b452b6bc83b57937", "lessThan": "20cf67dcb7db842f941eff1af6ee5e9dc41796d7", "versionType": "git"}, {"status": "affected", "version": "0e04dc26cc594d31ee6b1382b452b6bc83b57937", "lessThan": "2d33654d40a05afd91ab24c9a73ab512a0670a9a", "versionType": "git"}, {"status": "affected", "version": "0e04dc26cc594d31ee6b1382b452b6bc83b57937", "lessThan": "9525af1f58f67df387768770fcf6d6a8f23aee3d", "versionType": "git"}, {"status": "affected", "version": "0e04dc26cc594d31ee6b1382b452b6bc83b57937", "lessThan": "33d38c5da17f8db2d80e811b7829d2822c10625e", "versionType": "git"}, {"status": "affected", "version": "0e04dc26cc594d31ee6b1382b452b6bc83b57937", "lessThan": "69c7b2fe4c9cc1d3b1186d1c5606627ecf0de883", "versionType": "git"}], "programFiles": ["net/ceph/mon_client.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.6"}, {"status": "unaffected", "version": "0", "lessThan": "4.6", "versionType": "semver"}, {"status": "unaffected", "version": "4.19.318", "versionType": "semver", "lessThanOrEqual": "4.19.*"}, {"status": "unaffected", "version": "5.4.280", "versionType": "semver", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.222", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.163", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.100", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.41", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.9.10", "versionType": "semver", "lessThanOrEqual": "6.9.*"}, {"status": "unaffected", "version": "6.10", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/ceph/mon_client.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/1177afeca833174ba83504688eec898c6214f4bf"}, {"url": "https://git.kernel.org/stable/c/63e5d035e3a7ab7412a008f202633c5e6a0a28ea"}, {"url": "https://git.kernel.org/stable/c/34b76d1922e41da1fa73d43b764cddd82ac9733c"}, {"url": "https://git.kernel.org/stable/c/20cf67dcb7db842f941eff1af6ee5e9dc41796d7"}, {"url": "https://git.kernel.org/stable/c/2d33654d40a05afd91ab24c9a73ab512a0670a9a"}, {"url": "https://git.kernel.org/stable/c/9525af1f58f67df387768770fcf6d6a8f23aee3d"}, {"url": "https://git.kernel.org/stable/c/33d38c5da17f8db2d80e811b7829d2822c10625e"}, {"url": "https://git.kernel.org/stable/c/69c7b2fe4c9cc1d3b1186d1c5606627ecf0de883"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: fix race between delayed_work() and ceph_monc_stop()\n\nThe way the delayed work is handled in ceph_monc_stop() is prone to\nraces with mon_fault() and possibly also finish_hunting(). Both of\nthese can requeue the delayed work which wouldn't be canceled by any of\nthe following code in case that happens after cancel_delayed_work_sync()\nruns -- __close_session() doesn't mess with the delayed work in order\nto avoid interfering with the hunting interval logic. This part was\nmissed in commit b5d91704f53e (\"libceph: behave in mon_fault() if\ncur_mon < 0\") and use-after-free can still ensue on monc and objects\nthat hang off of it, with monc->auth and monc->monmap being\nparticularly susceptible to quickly being reused.\n\nTo fix this:\n\n- clear monc->cur_mon and monc->hunting as part of closing the session\n in ceph_monc_stop()\n- bail from delayed_work() if monc->cur_mon is cleared, similar to how\n it's done in mon_fault() and finish_hunting() (based on monc->hunting)\n- call cancel_delayed_work_sync() after the session is closed"}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.19.318", "versionStartIncluding": "4.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.4.280", "versionStartIncluding": "4.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.222", "versionStartIncluding": "4.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.163", "versionStartIncluding": "4.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.100", "versionStartIncluding": "4.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.41", "versionStartIncluding": "4.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.9.10", "versionStartIncluding": "4.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.10", "versionStartIncluding": "4.6"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-01-05T10:52:04.283Z"}}}, "cveMetadata": {"cveId": "CVE-2024-42232", "state": "PUBLISHED", "dateUpdated": "2026-01-05T10:52:04.283Z", "dateReserved": "2024-07-30T07:40:12.251Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-08-07T15:14:23.074Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/ceph/mon_client.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "1177afeca833174ba83504688eec898c6214f4bf", "status": "affected", "version": "0e04dc26cc594d31ee6b1382b452b6bc83b57937", "versionType": "git"}, {"lessThan": "63e5d035e3a7ab7412a008f202633c5e6a0a28ea", "status": "affected", "version": "0e04dc26cc594d31ee6b1382b452b6bc83b57937", "versionType": "git"}, {"lessThan": "34b76d1922e41da1fa73d43b764cddd82ac9733c", "status": "affected", "version": "0e04dc26cc594d31ee6b1382b452b6bc83b57937", "versionType": "git"}, {"lessThan": "20cf67dcb7db842f941eff1af6ee5e9dc41796d7", "status": "affected", "version": "0e04dc26cc594d31ee6b1382b452b6bc83b57937", "versionType": "git"}, {"lessThan": "2d33654d40a05afd91ab24c9a73ab512a0670a9a", "status": "affected", "version": "0e04dc26cc594d31ee6b1382b452b6bc83b57937", "versionType": "git"}, {"lessThan": "9525af1f58f67df387768770fcf6d6a8f23aee3d", "status": "affected", "version": "0e04dc26cc594d31ee6b1382b452b6bc83b57937", "versionType": "git"}, {"lessThan": "33d38c5da17f8db2d80e811b7829d2822c10625e", "status": "affected", "version": "0e04dc26cc594d31ee6b1382b452b6bc83b57937", "versionType": "git"}, {"lessThan": "69c7b2fe4c9cc1d3b1186d1c5606627ecf0de883", "status": "affected", "version": "0e04dc26cc594d31ee6b1382b452b6bc83b57937", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/ceph/mon_client.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.6"}, {"lessThan": "4.6", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.318", "versionType": "semver"}, {"lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.280", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.222", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.163", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.100", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.41", "versionType": "semver"}, {"lessThanOrEqual": "6.9.*", "status": "unaffected", "version": "6.9.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.10", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "43E390F8-BDB4-4990-B94D-095DD8369C31", "versionEndExcluding": "4.19.318", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "625DBFAB-C3D0-4309-A27F-12D6428FB38F", "versionEndExcluding": "5.4.280", "versionStartIncluding": "4.20", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "00696AC5-EE29-437F-97F9-C4D66608B327", "versionEndExcluding": "5.10.222", "versionStartIncluding": "5.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A97DEB09-4927-40F8-B5C6-F5BD5EAE0CFD", "versionEndExcluding": "5.15.163", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "100CDF74-4DB5-4FC6-A54B-BDBDB0C27137", "versionEndExcluding": "6.1.100", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "96AC42B8-D66D-4AC5-B466-E9BA7910FA29", "versionEndExcluding": "6.6.41", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "AB2E8DEC-CFD5-4C2B-981D-E7E45A36C352", "versionEndExcluding": "6.9.10", "versionStartIncluding": "6.7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: fix race between delayed_work() and ceph_monc_stop()\n\nThe way the delayed work is handled in ceph_monc_stop() is prone to\nraces with mon_fault() and possibly also finish_hunting(). Both of\nthese can requeue the delayed work which wouldn't be canceled by any of\nthe following code in case that happens after cancel_delayed_work_sync()\nruns -- __close_session() doesn't mess with the delayed work in order\nto avoid interfering with the hunting interval logic. This part was\nmissed in commit b5d91704f53e (\"libceph: behave in mon_fault() if\ncur_mon < 0\") and use-after-free can still ensue on monc and objects\nthat hang off of it, with monc->auth and monc->monmap being\nparticularly susceptible to quickly being reused.\n\nTo fix this:\n\n- clear monc->cur_mon and monc->hunting as part of closing the session\n in ceph_monc_stop()\n- bail from delayed_work() if monc->cur_mon is cleared, similar to how\n it's done in mon_fault() and finish_hunting() (based on monc->hunting)\n- call cancel_delayed_work_sync() after the session is closed"}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: libceph: corrige la ejecuci\u00f3n entre retardado_work() y ceph_monc_stop() La forma en que se maneja el trabajo retrasado en ceph_monc_stop() es propensa a ejecuci\u00f3ns con mon_fault() y posiblemente tambi\u00e9n con Finish_hunting(). Ambos pueden volver a poner en cola el trabajo retrasado que no ser\u00eda cancelado por ninguno de los siguientes c\u00f3digos en caso de que eso suceda despu\u00e9s de que se ejecute cancel_delayed_work_sync() - __close_session() no interfiere con el trabajo retrasado para evitar interferir con la b\u00fasqueda l\u00f3gica de intervalo. Esta parte se omiti\u00f3 en el commit b5d91704f53e (\"libceph: comportarse en mon_fault() si cur_mon &lt; 0\") y el use-after-free a\u00fan puede producirse en monc y los objetos que cuelgan de \u00e9l, con monc-&gt;auth y monc-&gt; monmap es particularmente susceptible de ser reutilizado r\u00e1pidamente. Para solucionar esto: - borre monc-&gt;cur_mon y monc-&gt;hunting como parte del cierre de la sesi\u00f3n en ceph_monc_stop() - libere de delay_work() si monc-&gt;cur_mon est\u00e1 borrado, similar a como se hace en mon_fault() y Finish_hunting () (basado en monc-&gt;hunting): llame a cancel_delayed_work_sync() despu\u00e9s de cerrar la sesi\u00f3n"}], "id": "CVE-2024-42232", "lastModified": "2026-08-04T11:19:39.860", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-42232", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:14:16.994766Z", "version": "2.0.3"}}]}, "published": "2024-08-07T16:15:46.213", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1177afeca833174ba83504688eec898c6214f4bf"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/20cf67dcb7db842f941eff1af6ee5e9dc41796d7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2d33654d40a05afd91ab24c9a73ab512a0670a9a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/33d38c5da17f8db2d80e811b7829d2822c10625e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/34b76d1922e41da1fa73d43b764cddd82ac9733c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/63e5d035e3a7ab7412a008f202633c5e6a0a28ea"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/69c7b2fe4c9cc1d3b1186d1c5606627ecf0de883"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9525af1f58f67df387768770fcf6d6a8f23aee3d"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: libceph: fix race between delayed_work() and ceph_monc_stop()", "id": "2303500", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2303500"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-362", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nlibceph: fix race between delayed_work() and ceph_monc_stop()\nThe way the delayed work is handled in ceph_monc_stop() is prone to\nraces with mon_fault() and possibly also finish_hunting(). Both of\nthese can requeue the delayed work which wouldn't be canceled by any of\nthe following code in case that happens after cancel_delayed_work_sync()\nruns -- __close_session() doesn't mess with the delayed work in order\nto avoid interfering with the hunting interval logic. This part was\nmissed in commit b5d91704f53e (\"libceph: behave in mon_fault() if\ncur_mon < 0\") and use-after-free can still ensue on monc and objects\nthat hang off of it, with monc->auth and monc->monmap being\nparticularly susceptible to quickly being reused.\nTo fix this:\n- clear monc->cur_mon and monc->hunting as part of closing the session\nin ceph_monc_stop()\n- bail from delayed_work() if monc->cur_mon is cleared, similar to how\nit's done in mon_fault() and finish_hunting() (based on monc->hunting)\n- call cancel_delayed_work_sync() after the session is closed", "A race condition vulnerability was found in the Linux kernel. Delayed work in ceph_monc_stop() is prone to race with mon_fault() and finish_hunting(), resulting in a denial of service."], "name": "CVE-2024-42232", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Will not fix", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Will not fix", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Will not fix", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-08-07T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-42232\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-42232\nhttps://lore.kernel.org/linux-cve-announce/2024080737-CVE-2024-42232-8ab2@gregkh/T"], "threat_severity": "Moderate"}

{}