Xiubo Li

Name of the Vulnerable Software and Affected Versions: Ceph versions 17.2.7, 18.2.1 through 18.2.4, 19.0.0 through 19.2.2 Description: Ceph is a distributed object, block, and file storage platform. An unprivileged user can escalate to root privileges in a ceph-fuse mounted CephFS by changing the permissions of a directory owned by root. This allows the user to read, write, and execute any directory owned by root, impacting confidentiality, integrity, and availability. Recommendations: For version 17.2.7, update to version 17.2.8. For versions 18.2.1 through 18.2.4, update to version 18.2.5. For versions 19.0.0 through 19.2.2, update to version 19.2.3.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A memory leak occurs in the ceph component of the Linux kernel within the `ceph readdir()` function. This issue is triggered when the `note last dentry()` function returns an error, failing to properly manage the `last readdir` variable. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** An inode reference leakage occurs in the `ceph get snapdir()` function. The `ceph get inode()` function searches for or inserts a new inode into the hash for the given `vino` and returns a reference to it; if `new` is non-NULL, its reference is consumed. The issue arises because the reference is not properly released during error handling cases. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A deadlock can occur in the Ceph component of the Linux kernel when a system is mounted with `wsync`. The issue arises during the creation of a file with `O RDWR` where the `i inline version` variable is incorrectly maintained as 1. When a buffer write is immediately performed, the system attempts to get capabilities and calls `ceph netfs issue op inline()`, which sends a `getattr(Fsr)` request to a metadata server (mds.1). A deadlock occurs because the metadata server (mds.0) attempts to revoke `Fxwb` capabilities from clients to transition the `CInode::filelock` state from exclusive to sync, while the kernel client already holds `Fwb` capabilities and is waiting for the `getattr(Fsr)` response. This involves the following functions: `ceph atomic open()`, `ceph init file info()`, `ceph uninline data()`, `ceph write iter()`, `ceph write begin()`, and `ceph netfs issue read()`. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.