Ilya Dryomov

The issue is related to a race condition between `delayed work()` and `ceph monc stop()` in the Linux kernel, specifically in the `libceph` module. This race condition can lead to a use-after-free scenario, particularly affecting `monc->auth` and `monc->monmap`. The problem arises because ` close session()` does not interfere with the delayed work to avoid disrupting the hunting interval logic, but this omission allows `mon fault()` and possibly `finish hunting()` to requeue the delayed work after `cancel delayed work sync()` has run, leading to potential use-after-free issues.

A flaw was found in the Cephx authentication protocol, where it does not verify Ceph clients correctly and is then vulnerable to replay attacks in Nautilus. This flaw allows an attacker with access to the Ceph cluster network to authenticate with the Ceph service via a packet sniffer and perform actions allowed by the Ceph service. The highest threat from this vulnerability is to confidentiality, integrity, and system availability.

The issue is related to incomplete permission checking for access to rbd devices in the Linux kernel, which could be exploited by local attackers to map or unmap rbd block devices, potentially allowing privilege escalation.

The issue allows local users to gain privileges or cause a denial of service (use-after-free) by leveraging improper access to a certain error field in the ext4 journal stop function.