Kernel Vulnerability in Linux Packages: Ceph Message Handling Issue
Summary
CVE-2022-48628: In the Linux kernel, the following vulnerability has been resolved: ceph: drop messages from MDS when unmounting When unmounting all the dirty buffers will be flushed and after the last osd request is finished the last r... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a critical component of many operating systems, providing the core interface between a computer's hardware and its processes. It is responsible for managing system resources and facilitating communication between software and hardware. The kernel supports various filesystems, including Ceph, which is a distributed storage system designed for scalability and fault tolerance. This vulnerability specifically affects the handling of messages from the Ceph Metadata Server (MDS) during the unmounting process, potentially leading to system instability and crashes.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the Ceph filesystem where, during the unmounting process, the kernel fails to properly handle messages from the MDS. When unmounting, all dirty buffers are flushed, and after the last OSD request is completed, the last reference of the inode count is released. The kernel does not wait for acknowledgments from the MDS, which can lead to inodes being skipped during eviction. If encryption is enabled, this can generate warnings when removing encryption keys, and ultimately, it may cause the kernel to crash when dereferencing released master keys.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid unmounting the Ceph filesystem while encryption is enabled until the kernel is updated. This can help prevent the warnings and potential crashes associated with the vulnerability.
Conclusion
The CVE-2022-48628 vulnerability in the Linux kernel poses a significant risk to systems using the Ceph filesystem, particularly during unmounting operations. Users are advised to update their kernel to mitigate this issue and consider using Vulert for ongoing vulnerability monitoring.
See every vulnerability recorded for linux →
FAQ
CVE-2022-48628 is a vulnerability in the Linux kernel affecting the Ceph filesystem, specifically related to message handling during the unmounting process.
This vulnerability can lead to system instability, warnings related to encryption keys, and potential kernel crashes when handling inodes.
You should update your Linux kernel to the latest version that includes the fix for this vulnerability.
Yes, you can use Vulert, which allows you to monitor and alert for open-source vulnerabilities in your software using just a manifest file. You can check your application at Vulert Scanner.
Vulert is a tool that monitors open-source vulnerabilities in software without requiring code access or installation, using a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
