CephFS kernel client (ceph.ko, ceph_handle_caps): The kernel trusts snap_trace_len straight off the wire, so a

Impact

The kernel trusts snap_trace_len straight off the wire, so a malicious or compromised MDS returns 0xFFFFFFFF and the client reads far past the message buffer before any authentication state is checked. Result is a kernel out-of-bounds read on every compute node mounting CephFS - crash at minimum, memory disclosure at worst.

Who can reach it

Anything that can speak MDS protocol to a CephFS kernel client: a compromised or spoofed MDS, or an attacker with a foothold on the storage fabric who can inject cap messages toward compute nodes.

What to do

Patch the kernel on all CephFS client nodes and reboot them. In the meantime run msgr2 secure mode so cap messages cannot be injected by a non-cluster party, and keep the Ceph public network unreachable from tenant workloads.

References