{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2023-52732","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2024-05-21T15:19:24.232Z","datePublished":"2024-05-21T15:22:57.926Z","dateUpdated":"2026-08-05T09:11:08.351Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T09:11:08.351Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nceph: blocklist the kclient when receiving corrupted snap trace\n\nWhen received corrupted snap trace we don't know what exactly has\nhappened in MDS side. And we shouldn't continue IOs and metadatas\naccess to MDS, which may corrupt or get incorrect contents.\n\nThis patch will just block all the further IO/MDS requests\nimmediately and then evict the kclient itself.\n\nThe reason why we still need to evict the kclient just after\nblocking all the further IOs is that the MDS could revoke the caps\nfaster."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL"},"scenarios":[{"lang":"en","value":"AV:N - Corrupted snap traces are delivered in MDS-originated CephFS messages (CEPH_MSG_CLIENT_SNAP, cap IMPORT snaptrace, reply snapblobs) over the TCP messenger path into ceph_update_snap_trace(); a malicious, compromised, or on-path MDS reaches the bug purely with network traffic.\nAC:L - A malicious MDS can craft an invalid snap trace that fails decode or partially applies realm state; pre-fix callers ignored the error and continued, so the condition is attacker-controlled and reliably repeatable with no race or other luck required.\nPR:N - Exploitation needs no privileges on the victim client—the attacking MDS peer requires no local account or capability, matching other CephFS client MDS-message bugs scored PR:N.\nUI:N - With CephFS already mounted (normal deployment state), the MDS can unilaterally push snap/cap messages (e.g. snapshot ops or reconnect) without any further victim action at exploit time.\nS:U - Impact stays inside the client kernel and CephFS mount authority; there is no VM escape, IOMMU bypass, or other cross-boundary effect.\nC:H - Ignored failures leave partially applied, attacker-influenced snap realm state in place, so subsequent reads can return incorrect snapshot/file contents—including other snaps’ data on a shared CephFS—which is a high confidentiality impact under the overestimate rule.\nI:H - The fix explicitly exists because continuing I/O after a corrupt snap trace can write with wrong snap contexts and corrupt snapshot contents on the OSDs; that is full integrity loss of CephFS snap data.\nA:H - Real reports show client hangs requiring reboot after corrupt snap traces, and continuing with inconsistent snap state can hit BUG_ON(!i_head_snapc) and related crash paths, so availability impact is High."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/ceph/addr.c","fs/ceph/caps.c","fs/ceph/file.c","fs/ceph/mds_client.c","fs/ceph/snap.c","fs/ceph/super.h"],"versions":[{"version":"9030aaf9bf0a1eee47a154c316c789e959638b0f","lessThan":"66ec619e4591f8350f99c5269a7ce160cccc7a7c","status":"affected","versionType":"git"},{"version":"9030aaf9bf0a1eee47a154c316c789e959638b0f","lessThan":"a68e564adcaa69b0930809fb64d9d5f7d9c32ba9","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/ceph/addr.c","fs/ceph/caps.c","fs/ceph/file.c","fs/ceph/mds_client.c","fs/ceph/snap.c","fs/ceph/super.h"],"versions":[{"version":"2.6.34","status":"affected"},{"version":"0","lessThan":"2.6.34","status":"unaffected","versionType":"semver"},{"version":"6.1.13","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.2","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.34","versionEndExcluding":"6.1.13"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.34","versionEndExcluding":"6.2"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/66ec619e4591f8350f99c5269a7ce160cccc7a7c"},{"url":"https://git.kernel.org/stable/c/a68e564adcaa69b0930809fb64d9d5f7d9c32ba9"}],"title":"ceph: blocklist the kclient when receiving corrupted snap trace","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2023-52732","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-05-21T17:31:40.303033Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2024-06-04T17:23:22.758Z"}},{"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-02T23:11:35.612Z"},"title":"CVE Program Container","references":[{"url":"https://git.kernel.org/stable/c/66ec619e4591f8350f99c5269a7ce160cccc7a7c","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/a68e564adcaa69b0930809fb64d9d5f7d9c32ba9","tags":["x_transferred"]}]}]}}