CVE-2024-56564

What it actually does

The vulnerability causes a credential reference leak in ceph_mds_auth_match() because a redundant get_current_cred() call is made after ceph_mds_check_access() has already obtained the pointer, preventing proper decrement of reference counts and resulting in memory corruption over repeated invocations.

Why it matters to the business

Systems using Ceph may experience gradual resource exhaustion from unreleased credential references, raising the risk of degraded performance or service disruption in storage clusters; low exploitation likelihood means limited immediate operational urgency despite the published fix.

How an attack unfolds

An attacker with access to trigger Ceph MDS authentication paths could repeatedly invoke ceph_mds_check_access() to accumulate leaked credential references; no named threat actors or campaigns are associated with this issue and public exploit maturity remains none.

How to fix it

Apply the kernel patch corresponding to commit ffa6ba7bdb7f07f49c9e9150b0176df066520f62 or upgrade to the fixed package versions listed for affected distributions such as squid3 3.3.8-1ubuntu6.8 on Ubuntu 14.04 LTS and 3.5.12-1ubuntu7.2 on Ubuntu 16.04 LTS.

How to confirm the fix worked

Verify the presence of the corrected code path that passes the cred pointer directly to ceph_mds_auth_match() instead of calling get_current_cred(), and confirm updated kernel or package versions are running on Ceph-enabled systems.

Typical attack path

1. Gain network or local access to a Ceph MDS server
2. Trigger repeated authentication or access checks via ceph_mds_check_access
3. Observe gradual increase in memory consumption due to unreleased cred references

How to detect it

Examine system and Ceph logs for repeated MDS authentication events combined with sustained memory growth in ceph-related processes; no specific post-exploitation artifacts are known.

What your security team should do

• Prioritize kernel and Ceph package updates on all affected hosts within standard maintenance windows
• Review Ceph MDS configurations to limit unnecessary authentication exposure
• Monitor memory usage trends for Ceph processes as a general hygiene measure