Linux kernel, libceph vulnerabilities

A vulnerability in the Linux kernel related to the libceph library has been resolved, concerning key length verification. The new CEPH_MAX_KEY_LEN check ensures that the key material fits into a fixed-size buffer.

In the Linux kernel, the libceph module (Ceph messenger v2 protocol) did not validate the payload_len field in the banner prefix. A client could send a banner with payload_len of 0, causing a 0-length socket read and violating a state machine invariant, triggering a warning in populate_in_iter(). Per the msgr2 specification, payload_len must be at least 16 bytes.

A vulnerability has been identified in the Linux kernel within libceph that may lead to a null pointer dereference in the ceph_handle_auth_reply() function. The issue occurs when a CEPH_MSG_AUTH_REPLY message contains zero values for both protocol and result, which is not currently treated as an error.

A vulnerability in the Linux kernel has been resolved in libceph, concerning the overzealous use of BUG_ON in the osdmap_apply_incremental() function. If the osdmap is maliciously corrupted, it should be declared invalid instead of triggering a bug.