« Volver al listado

CVE-2022-49296

Estado: ModificadaMedia (5.5)—

In the Linux kernel, the following vulnerability has been resolved:

ceph: fix possible deadlock when holding Fwb to get inline_data

1, mount with wsync. 2, create a file with O_RDWR, and the request was sent to mds.0:

The inline_version will be 1, which is the initial version for the new create file. And here the ci->i_inline_version will keep with 1, it's buggy.

3, buffer write to the file immediately:

The ceph_netfs_issue_op_inline() will send a getattr(Fsr) request to mds.1.

4, then the mds.1 will request the rd lock for CInode::filelock from the auth mds.0, the mds.0 will do the CInode::filelock state transation from excl --> sync, but it need to revoke the Fxwb caps back from the clients.

Leer descripción completaMostrar menos

While the kernel client has aleady held the Fwb caps and waiting for the getattr(Fsr).

It's deadlock!

URL: https://tracker.ceph.com/issues/55377

Detalles técnicos trazas, registros y código del informe original
   ceph_atomic_open()-->
     ceph_mdsc_do_request(openc)
     finish_open(file, dentry, ceph_open)-->
       ceph_open()-->
         ceph_init_file()-->
           ceph_init_file_info()-->
             ceph_uninline_data()-->
             {
               ...
               if (inline_version == 1 || /* initial version, no data */
                   inline_version == CEPH_INLINE_NONE)
                     goto out_unlock;
               ...
             }

   ceph_write_iter()-->
     ceph_get_caps(file, need=Fw, want=Fb, ...);
     generic_perform_write()-->
       a_ops->write_begin()-->
         ceph_write_begin()-->
           netfs_write_begin()-->
             netfs_begin_read()-->
               netfs_rreq_submit_slice()-->
                 netfs_read_from_server()-->
                   rreq->netfs_ops->issue_read()-->
                     ceph_netfs_issue_read()-->
                     {
                       ...
                       if (ci->i_inline_version != CEPH_INLINE_NONE &&
                           ceph_netfs_issue_op_inline(subreq))
                         return;
                       ...
                     }
     ceph_put_cap_refs(ci, Fwb);

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Linux — Linux Kernel

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-49296",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2022-49296",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-10-01T19:44:59.503744Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.5,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.8
      },
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.5,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "083db6fd3e73fc4f9ee74d2da1012a94216d6a60",
              "lessThan": "292b7a7275ce535a1abfa4dd0b2e586162aaae1e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "083db6fd3e73fc4f9ee74d2da1012a94216d6a60",
              "lessThan": "825978fd6a0defc3c29d8a38b6cea76a0938d21e",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "fs/ceph/addr.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.18"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "5.18",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.18.4",
              "versionType": "semver",
              "lessThanOrEqual": "5.18.*"
            },
            {
              "status": "unaffected",
              "version": "5.19",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "fs/ceph/addr.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2025-02-26T07:01:06.433",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/292b7a7275ce535a1abfa4dd0b2e586162aaae1e",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/825978fd6a0defc3c29d8a38b6cea76a0938d21e",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-667"
        }
      ]
    },
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-667"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nceph: fix possible deadlock when holding Fwb to get inline_data\n\n1, mount with wsync.\n2, create a file with O_RDWR, and the request was sent to mds.0:\n\n   ceph_atomic_open()-->\n     ceph_mdsc_do_request(openc)\n     finish_open(file, dentry, ceph_open)-->\n       ceph_open()-->\n         ceph_init_file()-->\n           ceph_init_file_info()-->\n             ceph_uninline_data()-->\n             {\n               ...\n               if (inline_version == 1 || /* initial version, no data */\n                   inline_version == CEPH_INLINE_NONE)\n                     goto out_unlock;\n               ...\n             }\n\nThe inline_version will be 1, which is the initial version for the\nnew create file. And here the ci->i_inline_version will keep with 1,\nit's buggy.\n\n3, buffer write to the file immediately:\n\n   ceph_write_iter()-->\n     ceph_get_caps(file, need=Fw, want=Fb, ...);\n     generic_perform_write()-->\n       a_ops->write_begin()-->\n         ceph_write_begin()-->\n           netfs_write_begin()-->\n             netfs_begin_read()-->\n               netfs_rreq_submit_slice()-->\n                 netfs_read_from_server()-->\n                   rreq->netfs_ops->issue_read()-->\n                     ceph_netfs_issue_read()-->\n                     {\n                       ...\n                       if (ci->i_inline_version != CEPH_INLINE_NONE &&\n                           ceph_netfs_issue_op_inline(subreq))\n                         return;\n                       ...\n                     }\n     ceph_put_cap_refs(ci, Fwb);\n\nThe ceph_netfs_issue_op_inline() will send a getattr(Fsr) request to\nmds.1.\n\n4, then the mds.1 will request the rd lock for CInode::filelock from\nthe auth mds.0, the mds.0 will do the CInode::filelock state transation\nfrom excl --> sync, but it need to revoke the Fxwb caps back from the\nclients.\n\nWhile the kernel client has aleady held the Fwb caps and waiting for\nthe getattr(Fsr).\n\nIt's deadlock!\n\nURL: https://tracker.ceph.com/issues/55377"
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ceph: se corrige un posible bloqueo al mantener presionado Fwb para obtener inline_data 1, montar con wsync. 2, crear un archivo con O_RDWR y la solicitud se envió a mds.0: ceph_atomic_open()--> ceph_mdsc_do_request(openc) finish_open(file, dentry, ceph_open)--> ceph_open()--> ceph_init_file()--> ceph_init_file_info()--> ceph_uninline_data()--> { ... if (inline_version == 1 || /* versión inicial, sin datos */ inline_version == CEPH_INLINE_NONE) goto out_unlock; ... } La inline_version será 1, que es la versión inicial para el nuevo archivo de creación. Y aquí, ci->i_inline_version se mantendrá con 1, es un error. 3, escribe en el búfer inmediatamente en el archivo: ceph_write_iter()--> ceph_get_caps(archivo, necesidad=Fw, deseo=Fb, ...); generic_perform_write()--> a_ops->write_begin()--> ceph_write_begin()--> netfs_write_begin()--> netfs_begin_read()--> netfs_rreq_submit_slice()--> netfs_read_from_server()--> rreq->netfs_ops->issue_read()--> ceph_netfs_issue_read()--> { ... if (ci->i_inline_version != CEPH_INLINE_NONE && ceph_netfs_issue_op_inline(subreq)) return; ... } ceph_put_cap_refs(ci, Fwb); El ceph_netfs_issue_op_inline() enviará una solicitud getattr(Fsr) a mds.1.4, luego mds.1 solicitará el bloqueo de rd para CInode::filelock desde el mds.0 de autenticación, el mds.0 realizará la transacción de estado de CInode::filelock desde excl --> sync, pero necesita revocar las capacidades Fxwb de los clientes. Mientras que el cliente del kernel ya ha retenido las capacidades Fwb y está esperando el getattr(Fsr). ¡Está en un punto muerto! URL: https://tracker.ceph.com/issues/55377"
    }
  ],
  "lastModified": "2026-08-13T00:17:31.190",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "48912B8B-BDF1-422C-9CA5-2DDFDBAADC80",
              "versionEndExcluding": "5.18.4",
              "versionStartIncluding": "2.6.34"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}