CVE-2024-42232

What it actually does

Race condition in libceph allows delayed_work() to operate on freed monc objects after ceph_monc_stop() because cancel_delayed_work_sync() can be bypassed by concurrent requeues from mon_fault() or finish_hunting(), resulting in use-after-free on monc->auth and monc->monmap structures.

Why it matters to the business

Local users on affected Linux systems using Ceph can trigger kernel crashes or memory corruption, leading to denial of service, potential local privilege escalation, and unplanned downtime for storage-dependent workloads.

How an attack unfolds

An attacker with local access triggers Ceph monitor client operations that race delayed work requeuing against session teardown in ceph_monc_stop(), causing the delayed work handler to dereference freed memory; listed threat actors have shown interest in similar Linux kernel memory-safety issues for espionage or financial gain but no public in-the-wild exploitation of this specific flaw is recorded.

How to fix it

Upgrade to a fixed kernel containing commit 1177afeca833174ba83504688eec898c6214f4bf or later; AlmaLinux users should update microdnf to version 3.8.0-2.el8 or newer; rebuild and reboot after applying the kernel package update.

How to confirm the fix worked

Confirm the running kernel contains commit 1177afeca833174ba83504688eec898c6214f4bf or the corresponding backport; verify that monc->cur_mon is cleared during ceph_monc_stop() and that delayed_work() bails when cur_mon is invalid.

Typical attack path

1. Obtain local shell or user context on a system running a vulnerable kernel with Ceph client enabled
2. Trigger or wait for Ceph monitor connection activity that invokes mon_fault() or finish_hunting() while ceph_monc_stop() is executing
3. Force the delayed work to execute after the monc structure has been freed
4. Achieve use-after-free dereference leading to crash or controlled memory corruption

How to detect it

Search kernel logs (dmesg, /var/log/kern.log, journalctl) for oops or panic messages referencing libceph, ceph_monc_stop, delayed_work, mon_fault, or use-after-free on monc objects; correlate with Ceph client connection teardown events.

• libceph.*use-after-free
• ceph_monc_stop.*delayed_work
• monc->cur_mon cleared during close
• kernel BUG at net/ceph/mon_client.c

What your security team should do

• Prioritize patching all Ceph client systems within the next maintenance window due to local attack surface
• Restrict untrusted local accounts and containers from accessing Ceph-enabled nodes until patched
• Monitor kernel logs for use-after-free oops involving libceph or ceph_monc structures