In the Linux kernel, the following vulnerability has been resolved:
ceph: fix UAF in check_new_map() on session freed during unlock
check_new_map() iterates mdsc->sessions[] and for each active session
drops mdsc->mutex to perform per-session operations. The forced-close
path (rank removed from map) correctly takes a reference on s via
ceph_get_mds_session() before releasing mdsc->mutex, but three other
paths do not:
Path A (address changed): mutex_unlock → mutex_lock(&s->s_mutex)
Path B (reconnect): mutex_unlock → send_mds_reconnect(mdsc, s)
Path C (active transition): mutex_unlock → mutex_lock(&s->s_mutex)
Without the extra reference, another thread can acquire mdsc->mutex
during the unlock window, call __unregister_session() which drops the
last reference on s, and free it. The original thread then accesses
freed memory via s->s_mutex.
Fix by adding ceph_get_mds_session(s) before each mutex_unlock and
ceph_put_mds_session(s) after the corresponding mutex_lock, matching
the pattern already used in the forced-close path.
Race timeline (Path A):
Thread A (check_new_map) Thread B (another map update
holds mdsc->mutex or session teardown)
-------------------------- --------------------------
s = mdsc->sessions[i]
(refcount == 1, held only by
sessions[] array)
mutex_unlock(&mdsc->mutex)
---> acquires mdsc->mutex
__unregister_session(mdsc, s)
sessions[i] = NULL
ceph_put_mds_session(s)
refcount: 1 -> 0
kfree(s) <--- freed!
mutex_lock(&s->s_mutex)
UAF on freed s->s_mutex
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 9.8
AV:N - check_new_map() runs from ceph_mdsc_handle_mdsmap() on CEPH_MSG_MDS_MAP received over TCP from a monitor (extra_mon_dispatch) or MDS (mds_dispatch); a malicious or compromised Ceph peer reaches the UAF on already-mounted CephFS clients without a local syscall.
AC:L - A cluster attacker controls both race sides: one TCP session delivers an MDS map that drops mdsc->mutex in the address-change, reconnect, or active-transition paths, while another concurrently sends a rank-removing map, CEPH_SESSION_CLOSE, or connection reset into __unregister_session(); Path B's send_mds_reconnect() GFP_NOFS work makes the window retryable.
PR:N - The attacker acts as the remote MON/MDS peer, or an on-path attacker on a legacy unsigned msgr session, and needs no UID, capability, or init-namespace root on the victim; any kernel CephFS client already connected to that cluster is exposed.
UI:N - Once CephFS is mounted, as is standard on Rook/Kubernetes, HPC, and cloud nodes, MDS-map updates and session teardown messages are processed automatically in ceph-msgr kworker context with no further victim mount, open, or interactive action.
S:U - The session-object use-after-free corrupts kernel heap on the client host within the same security authority and does not inherently cross a VM, IOMMU, or sandbox boundary.
C:H - Use-after-free of struct ceph_mds_session allows reclaim of the freed object so later reads of session fields, embedded connection state, and cap lists can disclose arbitrary kernel memory, matching CNA guidance that UAFs enable high confidentiality impact.
I:H - The same reclaimed session is written (s_mutex, s_state, ceph_con_close, reconnect and cap-kick paths), enabling heap corruption and hijack of the embedded ceph_connection ops for arbitrary kernel writes and control-flow hijacking.
A:H - Locking or dereferencing the freed session mutex and fields causes a kernel oops or panic, and the attacker can repeat map updates and session teardown to trigger the crash.
| Attack Vector |
Network |
Scope |
Unchanged |
| Attack Complexity |
Low |
Confidentiality Impact |
High |
| Privileges Required |
None |
Integrity Impact |
High |
| User Interaction |
None |
Availability Impact |
High |
AV:N - check_new_map() runs from ceph_mdsc_handle_mdsmap() on CEPH_MSG_MDS_MAP received over TCP from a monitor (extra_mon_dispatch) or MDS (mds_dispatch); a malicious or compromised Ceph peer reaches the UAF on already-mounted CephFS clients without a local syscall.
AC:L - A cluster attacker controls both race sides: one TCP session delivers an MDS map that drops mdsc->mutex in the address-change, reconnect, or active-transition paths, while another concurrently sends a rank-removing map, CEPH_SESSION_CLOSE, or connection reset into __unregister_session(); Path B's send_mds_reconnect() GFP_NOFS work makes the window retryable.
PR:N - The attacker acts as the remote MON/MDS peer, or an on-path attacker on a legacy unsigned msgr session, and needs no UID, capability, or init-namespace root on the victim; any kernel CephFS client already connected to that cluster is exposed.
UI:N - Once CephFS is mounted, as is standard on Rook/Kubernetes, HPC, and cloud nodes, MDS-map updates and session teardown messages are processed automatically in ceph-msgr kworker context with no further victim mount, open, or interactive action.
S:U - The session-object use-after-free corrupts kernel heap on the client host within the same security authority and does not inherently cross a VM, IOMMU, or sandbox boundary.
C:H - Use-after-free of struct ceph_mds_session allows reclaim of the freed object so later reads of session fields, embedded connection state, and cap lists can disclose arbitrary kernel memory, matching CNA guidance that UAFs enable high confidentiality impact.
I:H - The same reclaimed session is written (s_mutex, s_state, ceph_con_close, reconnect and cap-kick paths), enabling heap corruption and hijack of the embedded ceph_connection ops for arbitrary kernel writes and control-flow hijacking.
A:H - Locking or dereferencing the freed session mutex and fields causes a kernel oops or panic, and the attacker can repeat map updates and session teardown to trigger the crash.
CVSS 3.1