Xiubo Li

Name of the Vulnerable Software and Affected Versions: Ceph versions 17.2.7, 18.2.1 through 18.2.4, 19.0.0 through 19.2.2 Description: Ceph is a distributed object, block, and file storage platform. An unprivileged user can escalate to root privileges in a ceph-fuse mounted CephFS by changing the permissions of a directory owned by root. This allows the user to read, write, and execute any directory owned by root, impacting confidentiality, integrity, and availability. Recommendations: For version 17.2.7, update to version 17.2.8. For versions 18.2.1 through 18.2.4, update to version 18.2.5. For versions 19.0.0 through 19.2.2, update to version 19.2.3.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A memory leak issue in the Linux kernel has been identified and resolved. The problem occurred in the ceph readdir function when note last dentry returned an error. To address this, the last readdir is reset at the same time, and a comment has been added to explain why last readdir is not freed when dir emit returns false. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A vulnerability in the Linux kernel has been identified, related to the ceph get snapdir() function. The issue involves an inode reference leakage, which occurs when the ceph get inode() function searches for or inserts a new inode into the hash for a given vino and returns a reference to it. In error handling cases, the reference is not released, leading to a potential issue. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A potential deadlock issue has been identified in the Linux kernel related to the Ceph file system. The issue occurs when a file is created with O RDWR and a request is sent to the metadata server (mds). The `ceph atomic open()` function calls `ceph mdsc do request(openc)`, which can lead to a deadlock when the kernel client holds the Fwb caps and waits for a getattr(Fsr) request. This happens because the `ceph netfs issue op inline()` function sends a getattr(Fsr) request to mds, which then requests the rd lock for CInode::filelock from the auth mds, causing a state transition from excl to sync. However, this transition requires revoking the Fxwb caps back from the clients, leading to a deadlock. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.