CVE-2023-52732 ceph: blocklist the kclient when receiving corrupted snap trace
A corrupted snap trace in the Ceph kernel client can cause the client to be blocked and evicted, leading to a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-52732?
CVE-2023-52732 is a critical denial of service vulnerability in Linux kernel, published on 21 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ceph: blocklist the kclient when receiving corrupted snap trace
When received corrupted snap trace we don't know what exactly has happened in MDS side. And we shouldn't continue IOs and metadatas access to MDS, which may corrupt or get incorrect contents.
This patch will just block all the further IO/MDS requests immediately and then evict the kclient itself.
The reason why we still need to evict the kclient just after blocking all the further IOs is that the MDS could revoke the caps faster.
Which versions are affected by CVE-2023-52732?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2023-52732?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-52732 being exploited?
There is no known exploitation of CVE-2023-52732 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-67734, BELL-CVE-2023-52732, DEBIAN-CVE-2023-52732, GHSA-fwq5-vg2m-5cr5, ROOT-OS-DEBIAN-11-CVE-2023-52732, ROOT-OS-UBUNTU-2204-CVE-2023-52732 and 1 more.