{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-40362", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T07:20:57.187Z", "datePublished": "2025-12-16T13:40:02.467Z", "dateUpdated": "2026-08-05T12:09:54.515Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:09:54.515Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nceph: fix multifs mds auth caps issue\n\nThe mds auth caps check should also validate the\nfsname along with the associated caps. Not doing\nso would result in applying the mds auth caps of\none fs on to the other fs in a multifs ceph cluster.\nThe bug causes multiple issues w.r.t user\nauthentication, following is one such example.\n\nSteps to Reproduce (on vstart cluster):\n1. Create two file systems in a cluster, say 'fsname1' and 'fsname2'\n2. Authorize read only permission to the user 'client.usr' on fs 'fsname1'\n $ceph fs authorize fsname1 client.usr / r\n3. Authorize read and write permission to the same user 'client.usr' on fs 'fsname2'\n $ceph fs authorize fsname2 client.usr / rw\n4. Update the keyring\n $ceph auth get client.usr >> ./keyring\n\nWith above permssions for the user 'client.usr', following is the\nexpectation.\n a. The 'client.usr' should be able to only read the contents\n and not allowed to create or delete files on file system 'fsname1'.\n b. The 'client.usr' should be able to read/write on file system 'fsname2'.\n\nBut, with this bug, the 'client.usr' is allowed to read/write on file\nsystem 'fsname1'. See below.\n\n5. Mount the file system 'fsname1' with the user 'client.usr'\n $sudo bin/mount.ceph usr@.fsname1=/ /kmnt_fsname1_usr/\n6. Try creating a file on file system 'fsname1' with user 'client.usr'. This\n should fail but passes with this bug.\n $touch /kmnt_fsname1_usr/file1\n7. Mount the file system 'fsname1' with the user 'client.admin' and create a\n file.\n $sudo bin/mount.ceph admin@.fsname1=/ /kmnt_fsname1_admin\n $echo \"data\" > /kmnt_fsname1_admin/admin_file1\n8. Try removing an existing file on file system 'fsname1' with the user\n 'client.usr'. This shoudn't succeed but succeeds with the bug.\n $rm -f /kmnt_fsname1_usr/admin_file1\n\nFor more information, please take a look at the corresponding mds/fuse patch\nand tests added by looking into the tracker mentioned below.\n\nv2: Fix a possible null dereference in doutc\nv3: Don't store fsname from mdsmap, validate against\n ceph_mount_options's fsname and use it\nv4: Code refactor, better warning message and\n fix possible compiler warning\n\n[ Slava.Dubeyko: \"fsname check failed\" -> \"fsname mismatch\" ]" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The broken check is reached through ordinary local syscalls (`open`, `openat(O_CREAT)`, `unlink`, `rmdir`, `setattr`) on an already-mounted CephFS; the attacker acts on the client host, not over the wire.\nAC:L - No race, no memory-layout dependency — the attacker simply performs the file operation and the mismatched cap entry is applied deterministically; the multi-filesystem/`ceph fs authorize` configuration is a standard supported multi-tenant CephFS deployment.\nPR:L - Any unprivileged local user with access to the CephFS mount can trigger it; no capability, no user-namespace trick, and no cluster-side privilege is needed because the mount's cephx key is shared by all local users.\nUI:N - Exploitation requires no action by any other user or administrator beyond the mount already existing; the attacker's own file operations are sufficient.\nS:C - The kernel client enforces the Ceph cluster's cephx MDS auth policy on the cluster's behalf (the MDS delegates async-dirop authorization to it via CEPHFS_FEATURE_MDS_AUTH_CAPS_CHECK), so the bypass grants access to data in a different filesystem/tenant governed by the Ceph cluster's separate security authority.\nC:H - A cap entry belonging to another filesystem (e.g. `allow rw fsname=fs2 path=/`) is applied to the mounted filesystem, defeating `path=` and uid/gid read restrictions and exposing the contents of files the key was never authorized to read.\nI:H - The commit's reproducer shows a read-only-authorized user creating files and deleting an admin-written file on the restricted filesystem; root_squash and writeable=false restrictions are both defeated, giving unauthorized write over the tree.\nA:H - The same bypass permits unlink/rmdir and overwrite of other tenants' data on shared cluster storage, destroying data that legitimate users depend on." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/ceph/mds_client.c", "fs/ceph/mdsmap.c", "fs/ceph/super.c", "fs/ceph/super.h" ], "versions": [ { "version": "596afb0b8933ba6ed7227adcc538db26feb25c74", "lessThan": "07640d34a781bb2e39020a39137073c03c4aa932", "status": "affected", "versionType": "git" }, { "version": "596afb0b8933ba6ed7227adcc538db26feb25c74", "lessThan": "ca3da8b27ab9a0923ad477447cfb8fc7f4b4c523", "status": "affected", "versionType": "git" }, { "version": "596afb0b8933ba6ed7227adcc538db26feb25c74", "lessThan": "22c73d52a6d05c5a2053385c0d6cd9984732799d", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/ceph/mds_client.c", "fs/ceph/mdsmap.c", "fs/ceph/super.c", "fs/ceph/super.h" ], "versions": [ { "version": "6.10", "status": "affected" }, { "version": "0", "lessThan": "6.10", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.58", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.17.8", "lessThanOrEqual": "6.17.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.12.58" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.17.8" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.18" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/07640d34a781bb2e39020a39137073c03c4aa932" }, { "url": "https://git.kernel.org/stable/c/ca3da8b27ab9a0923ad477447cfb8fc7f4b4c523" }, { "url": "https://git.kernel.org/stable/c/22c73d52a6d05c5a2053385c0d6cd9984732799d" } ], "title": "ceph: fix multifs mds auth caps issue", "x_generator": { "engine": "bippy-1.2.0" } } } }