CVE-2024-56710

What it actually does

Memory leak of bvecs array allocated by iter_get_bvecs_alloc() when ceph_alloc_sparse_ext_map() fails in ceph_direct_read_write(), leaving pages pinned; similar leak path addressed in __ceph_sync_read().

Why it matters to the business

Gradual memory exhaustion on Ceph clients or servers under repeated error conditions during direct or sparse reads can degrade performance and force restarts, especially in large-scale storage deployments.

How an attack unfolds

An attacker with local access triggers the error path in ceph_direct_read_write() or __ceph_sync_read() repeatedly by forcing ceph_alloc_sparse_ext_map() to fail after bvecs allocation, accumulating leaked memory without any remote code execution or privilege escalation.

How to fix it

Apply kernel patches containing commit 44e518abbb498075ae85c7d1d1a503a6bb05ea2d or later; for Ubuntu 14.04 LTS use jasper 1.900.1-14ubuntu3.4 or newer; for Ubuntu 16.04 LTS use jasper 1.900.1-debian1-2.4ubuntu1.1 or newer; reboot affected nodes after update.

How to confirm the fix worked

Confirm kernel source contains the moved sparse_ext allocation before bvecs setup; run regression tests exercising direct and sync read paths with forced allocation failures; monitor slabinfo or /proc/meminfo for absence of bvecs leaks under load.

Typical attack path

1. Obtain local shell or unprivileged process on a Ceph client or server
2. Craft I/O operations that reach ceph_direct_read_write() or __ceph_sync_read()
3. Induce repeated failures in sparse extent map allocation after bvecs setup
4. Monitor system memory usage until exhaustion forces OOM kills or reboot

How to detect it

Search kernel logs and audit trails for repeated ceph_direct_read_write or __ceph_sync_read entries followed by allocation failures; correlate with rising slab or page cache usage without corresponding workload growth.

What your security team should do

• Prioritize patching Ceph-enabled kernels within standard change windows given low EPSS and no KEV listing
• Add memory-leak monitoring for Ceph I/O paths to existing observability dashboards
• Review Ceph client configurations to reduce exposure to sparse-extent read errors