CVE-2024-56563: 
Linux Kernel vulnerability analysis and mitigation

A credential leak vulnerability was discovered in the Linux kernel's Ceph filesystem implementation, specifically in the cephmdscheckaccess() function. The vulnerability was identified and disclosed on December 27, 2024. The issue occurs because getcurrentcred() increments the reference counter, but the corresponding putcred() call was missing, leading to a credential leak (Red Hat XML).

The vulnerability exists in the Linux kernel's Ceph filesystem code, specifically in the mdsclient.c file. The technical issue involves a missing putcred() call that should correspond to a getcurrentcred() operation, which increments the reference counter. The vulnerability has been assigned a CVSS 3.1 base score of 5.5 with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, indicating a low to moderate severity (Red Hat XML).

The credential leak in the Ceph filesystem implementation could potentially lead to resource exhaustion in the Linux kernel. The CVSS scoring indicates that while there is no impact on confidentiality or integrity, there is a high impact on availability (Red Hat XML).

The vulnerability has been fixed through a patch that adds the missing putcred() calls in the appropriate locations within the cephmdscheckaccess() function. The fix has been committed to the Linux kernel repository and is identified by commit c5cf420303256dcd6ff175643e9e9558543c2047 (Kernel Git).