CVE-2024-50179

What it actually does

Use-after-free in the Ceph filesystem driver when direct IO reads attempt to dirty pages without holding the required Fw capability reference.

Why it matters to the business

Linux systems using Ceph for storage face risk of kernel crashes, memory corruption, or potential privilege escalation, which can lead to service outages or data exposure in storage-heavy environments.

How an attack unfolds

An attacker with local access or control over a process performing direct IO reads against a Ceph-mounted filesystem triggers the missing Fw reference check, causing the kernel to access freed memory structures and enabling further exploitation for code execution.

How to fix it

Update the Linux kernel to a version containing commit c26c5ec832dd9e9dcd0a0a892a485c99889b68f0 or later stable releases that resolve the Ceph page dirtying logic.

How to confirm the fix worked

Verify the running kernel contains the referenced commit or is newer than the vulnerable versions; test direct IO read workloads on Ceph mounts to confirm absence of crashes or warnings.

Typical attack path

1. Obtain local execution context on a Linux host with Ceph filesystem mounted
2. Issue direct IO read operations that cause page dirtying without Fw caps
3. Trigger the incorrect reference check leading to use-after-free
4. Leverage the resulting memory corruption for privilege escalation or denial of service

How to detect it

Review kernel logs for Ceph-related use-after-free warnings or panics during direct IO; correlate with process activity performing reads on Ceph filesystems.

What your security team should do

• Prioritize kernel updates on all Ceph client systems within the next patching cycle
• Monitor for kernel oops or panic logs related to ceph during IO operations
• Restrict untrusted local access where Ceph mounts are present until patched