CVE-2025-40362

Estado: AplazadaAlta (8.8)—

In the Linux kernel, the following vulnerability has been resolved:

ceph: fix multifs mds auth caps issue

The mds auth caps check should also validate the fsname along with the associated caps. Not doing so would result in applying the mds auth caps of one fs on to the other fs in a multifs ceph cluster. The bug causes multiple issues w.r.t user authentication, following is one such example.

Steps to Reproduce (on vstart cluster): 1. Create two file systems in a cluster, say 'fsname1' and 'fsname2' 2.

Leer descripción completaMostrar menos

Authorize read only permission to the user 'client.usr' on fs 'fsname1' $ceph fs authorize fsname1 client.usr / r 3. Authorize read and write permission to the same user 'client.usr' on fs 'fsname2' $ceph fs authorize fsname2 client.usr / rw 4. Update the keyring $ceph auth get client.usr >> ./keyring

But, with this bug, the 'client.usr' is allowed to read/write on file system 'fsname1'. See below.

For more information, please take a look at the corresponding mds/fuse patch and tests added by looking into the tracker mentioned below.

v2: Fix a possible null dereference in doutc v3: Don't store fsname from mdsmap, validate against ceph_mount_options's fsname and use it v4: Code refactor, better warning message and fix possible compiler warning

[ Slava.Dubeyko: "fsname check failed" -> "fsname mismatch" ]

Detalles técnicos trazas, registros y código del informe original

With above permssions for the user 'client.usr', following is the
expectation.
  a. The 'client.usr' should be able to only read the contents
     and not allowed to create or delete files on file system 'fsname1'.
  b. The 'client.usr' should be able to read/write on file system 'fsname2'.

5. Mount the file system 'fsname1' with the user 'client.usr'
     $sudo bin/mount.ceph usr@.fsname1=/ /kmnt_fsname1_usr/
6. Try creating a file on file system 'fsname1' with user 'client.usr'. This
   should fail but passes with this bug.
     $touch /kmnt_fsname1_usr/file1
7. Mount the file system 'fsname1' with the user 'client.admin' and create a
   file.
     $sudo bin/mount.ceph admin@.fsname1=/ /kmnt_fsname1_admin
     $echo "data" > /kmnt_fsname1_admin/admin_file1
8. Try removing an existing file on file system 'fsname1' with the user
   'client.usr'. This shoudn't succeed but succeeds with the bug.
     $rm -f /kmnt_fsname1_usr/admin_file1

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Puntuación base: 8.8

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.16%
Percentil entre todas las CVEs puntuadas: 5
Fecha de la puntuación: 5/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1068 Exploitation for Privilege Escalationprivilege escalation85 %
Impacto principalT1078.003 Local Accountsstealth · persistence · privilege escalation · initial access80 %
Impacto secundarioT1565.001 Stored Data Manipulationimpact75 %

AV:L + PR:L sin UI permite escalada local: usuario con permisos limitados (readonly) en fsname1 logra permisos write. La validación de fsname fallida causa bypass de controles de acceso y manipulación de datos no autorizados.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

User Account Management Threat Intelligence Program Restrict File and Directory Permissions Privileged Account Management Password Policies Remote Data Storage

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux Kernel^AI

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2025-40362",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 2
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "596afb0b8933ba6ed7227adcc538db26feb25c74",
              "lessThan": "07640d34a781bb2e39020a39137073c03c4aa932",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "596afb0b8933ba6ed7227adcc538db26feb25c74",
              "lessThan": "ca3da8b27ab9a0923ad477447cfb8fc7f4b4c523",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "596afb0b8933ba6ed7227adcc538db26feb25c74",
              "lessThan": "22c73d52a6d05c5a2053385c0d6cd9984732799d",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "fs/ceph/mds_client.c",
            "fs/ceph/mdsmap.c",
            "fs/ceph/super.c",
            "fs/ceph/super.h"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "6.10",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.12.58",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.17.8",
              "versionType": "semver",
              "lessThanOrEqual": "6.17.*"
            },
            {
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "fs/ceph/mds_client.c",
            "fs/ceph/mdsmap.c",
            "fs/ceph/super.c",
            "fs/ceph/super.h"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2025-12-16T14:15:48.217",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/07640d34a781bb2e39020a39137073c03c4aa932",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/22c73d52a6d05c5a2053385c0d6cd9984732799d",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/ca3da8b27ab9a0923ad477447cfb8fc7f4b4c523",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Deferred",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nceph: fix multifs mds auth caps issue\n\nThe mds auth caps check should also validate the\nfsname along with the associated caps. Not doing\nso would result in applying the mds auth caps of\none fs on to the other fs in a multifs ceph cluster.\nThe bug causes multiple issues w.r.t user\nauthentication, following is one such example.\n\nSteps to Reproduce (on vstart cluster):\n1. Create two file systems in a cluster, say 'fsname1' and 'fsname2'\n2. Authorize read only permission to the user 'client.usr' on fs 'fsname1'\n    $ceph fs authorize fsname1 client.usr / r\n3. Authorize read and write permission to the same user 'client.usr' on fs 'fsname2'\n    $ceph fs authorize fsname2 client.usr / rw\n4. Update the keyring\n    $ceph auth get client.usr >> ./keyring\n\nWith above permssions for the user 'client.usr', following is the\nexpectation.\n  a. The 'client.usr' should be able to only read the contents\n     and not allowed to create or delete files on file system 'fsname1'.\n  b. The 'client.usr' should be able to read/write on file system 'fsname2'.\n\nBut, with this bug, the 'client.usr' is allowed to read/write on file\nsystem 'fsname1'. See below.\n\n5. Mount the file system 'fsname1' with the user 'client.usr'\n     $sudo bin/mount.ceph usr@.fsname1=/ /kmnt_fsname1_usr/\n6. Try creating a file on file system 'fsname1' with user 'client.usr'. This\n   should fail but passes with this bug.\n     $touch /kmnt_fsname1_usr/file1\n7. Mount the file system 'fsname1' with the user 'client.admin' and create a\n   file.\n     $sudo bin/mount.ceph admin@.fsname1=/ /kmnt_fsname1_admin\n     $echo \"data\" > /kmnt_fsname1_admin/admin_file1\n8. Try removing an existing file on file system 'fsname1' with the user\n   'client.usr'. This shoudn't succeed but succeeds with the bug.\n     $rm -f /kmnt_fsname1_usr/admin_file1\n\nFor more information, please take a look at the corresponding mds/fuse patch\nand tests added by looking into the tracker mentioned below.\n\nv2: Fix a possible null dereference in doutc\nv3: Don't store fsname from mdsmap, validate against\n    ceph_mount_options's fsname and use it\nv4: Code refactor, better warning message and\n    fix possible compiler warning\n\n[ Slava.Dubeyko: \"fsname check failed\" -> \"fsname mismatch\" ]"
    }
  ],
  "lastModified": "2026-07-30T06:24:31.320",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}