In the Linux kernel, the following vulnerability has been resolved:

libceph: refresh auth->authorizer_buf{,_len} after authorizer update

ceph_x_create_authorizer() caches au->buf->vec.iov_base and
au->buf->vec.iov_len in struct ceph_auth_handshake.  These
cached values are then used by the messenger connect code when
sending the authorizer.

ceph_x_update_authorizer() can rebuild the authorizer when a newer
service ticket is available.  If the rebuilt authorizer no longer
fits in the existing buffer, ceph_x_build_authorizer() drops its
reference to au->buf and allocates a new one.  If this is the final
reference, ceph_buffer_put() frees the old ceph_buffer and its
vec.iov_base, but auth->authorizer_buf still points at that freed
memory.

A subsequent msgr1 reconnect can therefore queue the stale pointer
and trigger a KASAN slab-use-after-free in _copy_from_iter() while
tcp_sendmsg() copies the authorizer.

Refresh auth->authorizer_buf and auth->authorizer_buf_len after a
successful authorizer rebuild so the messenger sends the current
buffer.

https://git.kernel.org/stable/c/0060ec912292a550198d8d18ac95b433c92a7091

https://git.kernel.org/stable/c/5ecfcd5c05866f185357700b81b461dae4f5ebb2

https://git.kernel.org/stable/c/75e82e8944ac1efe9fdb88bd2f14d9a031282bdf

https://git.kernel.org/stable/c/937d61f86d377a3aa578adae7a3dfcecdddf9d89

https://git.kernel.org/stable/c/9d37aec9ffe4e743dabc3f84502e9723e17a30d4

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/ceph/auth_x.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"0bed9b5c523d577378b6f83eab5835fe30c27208","lessThan":"9d37aec9ffe4e743dabc3f84502e9723e17a30d4","versionType":"git","status":"affected"},{"version":"0bed9b5c523d577378b6f83eab5835fe30c27208","lessThan":"75e82e8944ac1efe9fdb88bd2f14d9a031282bdf","versionType":"git","status":"affected"},{"version":"0bed9b5c523d577378b6f83eab5835fe30c27208","lessThan":"0060ec912292a550198d8d18ac95b433c92a7091","versionType":"git","status":"affected"},{"version":"0bed9b5c523d577378b6f83eab5835fe30c27208","lessThan":"5ecfcd5c05866f185357700b81b461dae4f5ebb2","versionType":"git","status":"affected"},{"version":"0bed9b5c523d577378b6f83eab5835fe30c27208","lessThan":"937d61f86d377a3aa578adae7a3dfcecdddf9d89","versionType":"git","status":"affected"},{"version":"29c65a277a64645af853e8c9a9b3dda0ddc421e0","versionType":"git","status":"affected"},{"version":"d2c7223497cf8228416c70e3f4238ddd6c5bdf3c","versionType":"git","status":"affected"},{"version":"3.4.50","lessThan":"3.5","versionType":"semver","status":"affected"},{"version":"3.9.7","lessThan":"3.10","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/ceph/auth_x.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.10","status":"affected"},{"version":"0","lessThan":"3.10","versionType":"semver","status":"unaffected"},{"version":"6.6.148","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.101","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.42","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.6","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc5","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]