Linux kernel (libceph) vulnerabilities

In the Linux kernel, the ceph_handle_auth_reply() function in libceph contains an integer overflow vulnerability. The payload_len field from a CEPH_MSG_AUTH_REPLY message is stored as an int, so a value greater than INT_MAX becomes negative, leading to an out-of-bounds memory access. The fix changes the type to u32 and adds additional segment length sanity checks.

In the Linux kernel, the libceph module (Ceph messenger v2 protocol) did not validate the payload_len field in the banner prefix. A client could send a banner with payload_len of 0, causing a 0-length socket read and violating a state machine invariant, triggering a warning in populate_in_iter(). Per the msgr2 specification, payload_len must be at least 16 bytes.

A vulnerability has been identified in the Linux kernel within libceph that may lead to a null pointer dereference in the ceph_handle_auth_reply() function. The issue occurs when a CEPH_MSG_AUTH_REPLY message contains zero values for both protocol and result, which is not currently treated as an error.

A vulnerability in the Linux kernel has been resolved in libceph, concerning the overzealous use of BUG_ON in the osdmap_apply_incremental() function. If the osdmap is maliciously corrupted, it should be declared invalid instead of triggering a bug.