CVE-2024-56563: 
Linux Kernel vulnerability analysis and mitigation

A credential leak vulnerability was discovered in the Linux kernel's Ceph filesystem implementation, specifically in the ceph_mds_check_access() function. The vulnerability was identified and disclosed on December 27, 2024. The issue occurs because get_current_cred() increments the reference counter, but the corresponding put_cred() call was missing, leading to a credential leak (Red Hat XML).

The vulnerability exists in the Linux kernel's Ceph filesystem code, specifically in the mds_client.c file. The technical issue involves a missing put_cred() call that should correspond to a get_current_cred() operation, which increments the reference counter. The vulnerability has been assigned a CVSS 3.1 base score of 5.5 with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, indicating a low to moderate severity (Red Hat XML).

The credential leak in the Ceph filesystem implementation could potentially lead to resource exhaustion in the Linux kernel. The CVSS scoring indicates that while there is no impact on confidentiality or integrity, there is a high impact on availability (Red Hat XML).

The vulnerability requires local access with low complexity and low privileges to exploit. No user interaction is required for exploitation, as indicated by the CVSS vector string (Red Hat XML).

The vulnerability has been fixed through a patch that adds the missing put_cred() calls in the appropriate locations within the ceph_mds_check_access() function. The fix has been committed to the Linux kernel repository and is identified by commit c5cf420303256dcd6ff175643e9e9558543c2047 (Kernel Git).