{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2022-49770", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T07:17:33.805Z", "datePublished": "2025-05-01T14:09:08.173Z", "dateUpdated": "2026-08-15T12:22:57.784Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-15T12:22:57.784Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nceph: avoid putting the realm twice when decoding snaps fails\n\nWhen decoding the snaps fails it maybe leaving the 'first_realm'\nand 'realm' pointing to the same snaprealm memory. And then it'll\nput it twice and could cause random use-after-free, BUG_ON, etc\nissues." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "scenarios": [ { "lang": "en", "value": "AV:N - Corrupted snap traces reach ceph_update_snap_trace() via MDS-originated CephFS messages (CEPH_MSG_CLIENT_SNAP, cap IMPORT snaptrace, reply snapblobs) over the TCP messenger; a malicious, compromised, or on-path MDS triggers the bug with network traffic alone.\nAC:L - A malicious MDS can craft a multi-realm snap trace whose first realm decodes successfully (setting first_realm) and whose subsequent record fails ceph_decode_need, reliably hitting the double-put path with no race or layout dependency.\nPR:N - Exploitation needs no privileges on the victim client—the attacking MDS peer requires no local account or capability, matching other CephFS client MDS-message bugs scored PR:N.\nUI:N - With CephFS already mounted (normal deployment state), the MDS can unilaterally push snap/cap messages during snapshot ops or reconnect without any further victim action at exploit time.\nS:U - Impact stays inside the client kernel and CephFS mount authority; there is no VM escape, IOMMU bypass, or other cross-boundary effect.\nC:H - Double-putting the snap realm frees struct ceph_snap_realm while inodes and hierarchy links retain dangling pointers, yielding a classic heap UAF read primitive over attacker-reclaimable slab memory.\nI:H - The same UAF write path (nref/list updates on a recycled snap_realm, plus later use via get_quota_realm/ceph_get_snap_realm) enables heap corruption and control-flow hijack primitives.\nA:H - Production reports show LIST_POISON GPFs and client hangs requiring reboot after the double-put, and any UAF of this form can oops or panic the kernel." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/ceph/snap.c" ], "versions": [ { "version": "982d6011bc30a26e8a3d546e0e7fc7db2c255d85", "lessThan": "274e4c79a3a2a24fba7cfe0e41113f1138785c37", "status": "affected", "versionType": "git" }, { "version": "982d6011bc30a26e8a3d546e0e7fc7db2c255d85", "lessThan": "cb7495fe957526555782ce0723f79ce92a6db22e", "status": "affected", "versionType": "git" }, { "version": "982d6011bc30a26e8a3d546e0e7fc7db2c255d85", "lessThan": "044bc6d3c2c0e9090b0841e7b723875756534b45", "status": "affected", "versionType": "git" }, { "version": "982d6011bc30a26e8a3d546e0e7fc7db2c255d85", "lessThan": "2f6e2de3a5289004650118b61f138fe7c28e1905", "status": "affected", "versionType": "git" }, { "version": "982d6011bc30a26e8a3d546e0e7fc7db2c255d85", "lessThan": "fd879c83e87735ab8f00ef7755752cf0cbae24b2", "status": "affected", "versionType": "git" }, { "version": "982d6011bc30a26e8a3d546e0e7fc7db2c255d85", "lessThan": "51884d153f7ec85e18d607b2467820a90e0f4359", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/ceph/snap.c" ], "versions": [ { "version": "4.0", "status": "affected" }, { "version": "0", "lessThan": "4.0", "status": "unaffected", "versionType": "semver" }, { "version": "4.19.268", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.226", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.157", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.81", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.0.10", "lessThanOrEqual": "6.0.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.0", "versionEndExcluding": "4.19.268" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.0", "versionEndExcluding": "5.4.226" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.0", "versionEndExcluding": "5.10.157" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.0", "versionEndExcluding": "5.15.81" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.0", "versionEndExcluding": "6.0.10" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.0", "versionEndExcluding": "6.1" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/274e4c79a3a2a24fba7cfe0e41113f1138785c37" }, { "url": "https://git.kernel.org/stable/c/cb7495fe957526555782ce0723f79ce92a6db22e" }, { "url": "https://git.kernel.org/stable/c/044bc6d3c2c0e9090b0841e7b723875756534b45" }, { "url": "https://git.kernel.org/stable/c/2f6e2de3a5289004650118b61f138fe7c28e1905" }, { "url": "https://git.kernel.org/stable/c/fd879c83e87735ab8f00ef7755752cf0cbae24b2" }, { "url": "https://git.kernel.org/stable/c/51884d153f7ec85e18d607b2467820a90e0f4359" } ], "title": "ceph: avoid putting the realm twice when decoding snaps fails", "x_generator": { "engine": "bippy-1.2.0" } } } }