Към съдържанието
Търсене

CVE-2025-68285: Linux

9.8

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се по мрежата, без особени условия, без вход и без действие от потребителя.

  • Експлоатация: няма данни за експлоатация
  • Атаката не може да се автоматизира

Описание

Оригинално описание

In the Linux kernel, the following vulnerability has been resolved: libceph: fix potential use-after-free in have_mon_and_osd_map() The wait loop in __ceph_open_session() can race with the client receiving a new monmap or osdmap shortly after the initial map is received. Both ceph_monc_handle_map() and handle_one_map() install a new map immediately after freeing the old one kfree(monc->monmap); monc->monmap = monmap; ceph_osdmap_destroy(osdc->osdmap); osdc->osdmap = newmap; under client->monc.mutex and client->osdc.lock respectively, but because neither is taken in have_mon_and_osd_map() it's possible for client->monc.monmap->epoch and client->osdc.osdmap->epoch arms in client->monc.monmap && client->monc.monmap->epoch && client->osdc.osdmap && client->osdc.osdmap->epoch; condition to dereference an already freed map. This happens to be reproducible with generic/395 and generic/397 with KASAN enabled: BUG: KASAN: slab-use-after-free in have_mon_and_osd_map+0x56/0x70 Read of size 4 at addr ffff88811012d810 by task mount.ceph/13305 CPU: 2 UID: 0 PID: 13305 Comm: mount.ceph Not tainted 6.14.0-rc2-build2+ #1266 ... Call Trace: <TASK> have_mon_and_osd_map+0x56/0x70 ceph_open_session+0x182/0x290 ceph_get_tree+0x333/0x680 vfs_get_tree+0x49/0x180 do_new_mount+0x1a3/0x2d0 path_mount+0x6dd/0x730 do_mount+0x99/0xe0 __do_sys_mount+0x141/0x180 do_syscall_64+0x9f/0x100 entry_SYSCALL_64_after_hwframe+0x76/0x7e </TASK> Allocated by task 13305: ceph_osdmap_alloc+0x16/0x130 ceph_osdc_init+0x27a/0x4c0 ceph_create_client+0x153/0x190 create_fs_client+0x50/0x2a0 ceph_get_tree+0xff/0x680 vfs_get_tree+0x49/0x180 do_new_mount+0x1a3/0x2d0 path_mount+0x6dd/0x730 do_mount+0x99/0xe0 __do_sys_mount+0x141/0x180 do_syscall_64+0x9f/0x100 entry_SYSCALL_64_after_hwframe+0x76/0x7e Freed by task 9475: kfree+0x212/0x290 handle_one_map

Засегнати продукти

  • Linux Linux: 6822d00b5462e7a9dfa11dcc60cc25823a2107c5 преди bb4910c5fd436701faf367e1b5476a5a6d2aff1c; 6822d00b5462e7a9dfa11dcc60cc25823a2107c5 преди 05ec43e9a9de67132dc8cd3b22afef001574947f; 6822d00b5462e7a9dfa11dcc60cc25823a2107c5 преди 7c8ccdc1714d9fabecd26e1be7db1771061acc6e; 6822d00b5462e7a9dfa11dcc60cc25823a2107c5 преди 183ad6e3b651e8fb0b66d6a2678f4b80bfbba092; 6822d00b5462e7a9dfa11dcc60cc25823a2107c5 преди e08021b3b56b2407f37b5fe47b654be80cc665fb; 6822d00b5462e7a9dfa11dcc60cc25823a2107c5 преди 3fc43120b22a3d4f1fbeff56a35ce2105b6a5683; 6822d00b5462e7a9dfa11dcc60cc25823a2107c5 преди 076381c261374c587700b3accf410bdd2dba334e
  • Linux Linux: 2.6.35; преди 2.6.35; 5.10.247 до 5.10.*; 5.15.197 до 5.15.*; 6.1.159 до 6.1.*; 6.6.119 до 6.6.*; 6.12.61 до 6.12.*; 6.17.11 до 6.17.*; 6.18 до *

История

  • 16 декември 2025 Публикувано

Други уязвимости в Linux Linux

Първоизточници

CVE-2025-68285: Linux | freedomonline.bg