CVE-2023-52732 (GCVE-0-2023-52732)

Vulnerability from cvelistv5 – Published: 2024-05-21 15:22 – Updated: 2026-08-05 09:11
VLAI
Title
ceph: blocklist the kclient when receiving corrupted snap trace
Summary
In the Linux kernel, the following vulnerability has been resolved: ceph: blocklist the kclient when receiving corrupted snap trace When received corrupted snap trace we don't know what exactly has happened in MDS side. And we shouldn't continue IOs and metadatas access to MDS, which may corrupt or get incorrect contents. This patch will just block all the further IO/MDS requests immediately and then evict the kclient itself. The reason why we still need to evict the kclient just after blocking all the further IOs is that the MDS could revoke the caps faster.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-05-21 17:31 UTC
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 9030aaf9bf0a1eee47a154c316c789e959638b0f , < 66ec619e4591f8350f99c5269a7ce160cccc7a7c (git)
Affected: 9030aaf9bf0a1eee47a154c316c789e959638b0f , < a68e564adcaa69b0930809fb64d9d5f7d9c32ba9 (git)
Create a notification for this product.
Linux Linux Affected: 2.6.34
Unaffected: 0 , < 2.6.34 (semver)
Unaffected: 6.1.13 , ≤ 6.1.* (semver)
Unaffected: 6.2 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-52732",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-21T17:31:40.303033Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:23:22.758Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T23:11:35.612Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/66ec619e4591f8350f99c5269a7ce160cccc7a7c"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a68e564adcaa69b0930809fb64d9d5f7d9c32ba9"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ceph/addr.c",
            "fs/ceph/caps.c",
            "fs/ceph/file.c",
            "fs/ceph/mds_client.c",
            "fs/ceph/snap.c",
            "fs/ceph/super.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "66ec619e4591f8350f99c5269a7ce160cccc7a7c",
              "status": "affected",
              "version": "9030aaf9bf0a1eee47a154c316c789e959638b0f",
              "versionType": "git"
            },
            {
              "lessThan": "a68e564adcaa69b0930809fb64d9d5f7d9c32ba9",
              "status": "affected",
              "version": "9030aaf9bf0a1eee47a154c316c789e959638b0f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ceph/addr.c",
            "fs/ceph/caps.c",
            "fs/ceph/file.c",
            "fs/ceph/mds_client.c",
            "fs/ceph/snap.c",
            "fs/ceph/super.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.34"
            },
            {
              "lessThan": "2.6.34",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.13",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nceph: blocklist the kclient when receiving corrupted snap trace\n\nWhen received corrupted snap trace we don\u0027t know what exactly has\nhappened in MDS side. And we shouldn\u0027t continue IOs and metadatas\naccess to MDS, which may corrupt or get incorrect contents.\n\nThis patch will just block all the further IO/MDS requests\nimmediately and then evict the kclient itself.\n\nThe reason why we still need to evict the kclient just after\nblocking all the further IOs is that the MDS could revoke the caps\nfaster."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - Corrupted snap traces are delivered in MDS-originated CephFS messages (CEPH_MSG_CLIENT_SNAP, cap IMPORT snaptrace, reply snapblobs) over the TCP messenger path into ceph_update_snap_trace(); a malicious, compromised, or on-path MDS reaches the bug purely with network traffic.\nAC:L - A malicious MDS can craft an invalid snap trace that fails decode or partially applies realm state; pre-fix callers ignored the error and continued, so the condition is attacker-controlled and reliably repeatable with no race or other luck required.\nPR:N - Exploitation needs no privileges on the victim client\u2014the attacking MDS peer requires no local account or capability, matching other CephFS client MDS-message bugs scored PR:N.\nUI:N - With CephFS already mounted (normal deployment state), the MDS can unilaterally push snap/cap messages (e.g. snapshot ops or reconnect) without any further victim action at exploit time.\nS:U - Impact stays inside the client kernel and CephFS mount authority; there is no VM escape, IOMMU bypass, or other cross-boundary effect.\nC:H - Ignored failures leave partially applied, attacker-influenced snap realm state in place, so subsequent reads can return incorrect snapshot/file contents\u2014including other snaps\u2019 data on a shared CephFS\u2014which is a high confidentiality impact under the overestimate rule.\nI:H - The fix explicitly exists because continuing I/O after a corrupt snap trace can write with wrong snap contexts and corrupt snapshot contents on the OSDs; that is full integrity loss of CephFS snap data.\nA:H - Real reports show client hangs requiring reboot after corrupt snap traces, and continuing with inconsistent snap state can hit BUG_ON(!i_head_snapc) and related crash paths, so availability impact is High."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:11:08.351Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/66ec619e4591f8350f99c5269a7ce160cccc7a7c"
        },
        {
          "url": "https://git.kernel.org/stable/c/a68e564adcaa69b0930809fb64d9d5f7d9c32ba9"
        }
      ],
      "title": "ceph: blocklist the kclient when receiving corrupted snap trace",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-52732",
    "datePublished": "2024-05-21T15:22:57.926Z",
    "dateReserved": "2024-05-21T15:19:24.232Z",
    "dateUpdated": "2026-08-05T09:11:08.351Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-52732",
      "date": "2026-08-12",
      "epss": "0.00522",
      "percentile": "0.4168"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nceph: blocklist the kclient when receiving corrupted snap trace\\n\\nWhen received corrupted snap trace we don\u0027t know what exactly has\\nhappened in MDS side. And we shouldn\u0027t continue IOs and metadatas\\naccess to MDS, which may corrupt or get incorrect contents.\\n\\nThis patch will just block all the further IO/MDS requests\\nimmediately and then evict the kclient itself.\\n\\nThe reason why we still need to evict the kclient just after\\nblocking all the further IOs is that the MDS could revoke the caps\\nfaster.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ceph: lista de bloqueo del kclient cuando se recibe un seguimiento instant\\u00e1neo corrupto. Cuando recibimos un seguimiento instant\\u00e1neo corrupto, no sabemos qu\\u00e9 ha sucedido exactamente en el lado MDS. Y no debemos continuar con el acceso de IO y metadatos a MDS, lo que puede da\\u00f1ar u obtener contenidos incorrectos. Este parche simplemente bloquear\\u00e1 todas las solicitudes IO/MDS adicionales inmediatamente y luego expulsar\\u00e1 al propio kclient. La raz\\u00f3n por la que todav\\u00eda necesitamos desalojar al kclient justo despu\\u00e9s de bloquear todas las IO adicionales es que el MDS podr\\u00eda revocar los l\\u00edmites m\\u00e1s r\\u00e1pido.\"}]",
      "id": "CVE-2023-52732",
      "lastModified": "2024-11-21T08:40:28.117",
      "published": "2024-05-21T16:15:13.303",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/66ec619e4591f8350f99c5269a7ce160cccc7a7c\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/a68e564adcaa69b0930809fb64d9d5f7d9c32ba9\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/66ec619e4591f8350f99c5269a7ce160cccc7a7c\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/a68e564adcaa69b0930809fb64d9d5f7d9c32ba9\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "microsoft_vex": {
      "current_release_date": "2026-03-31T15:10:36.000Z",
      "cve": "CVE-2023-52732",
      "id": "msrc_CVE-2023-52732",
      "initial_release_date": "2024-05-02T07:00:00.000Z",
      "product_status:known_affected": "3",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "ceph: blocklist the kclient when receiving corrupted snap trace",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2023-52732.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-52732\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-21T16:15:13.303\",\"lastModified\":\"2026-08-04T10:18:38.937\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nceph: blocklist the kclient when receiving corrupted snap trace\\n\\nWhen received corrupted snap trace we don\u0027t know what exactly has\\nhappened in MDS side. And we shouldn\u0027t continue IOs and metadatas\\naccess to MDS, which may corrupt or get incorrect contents.\\n\\nThis patch will just block all the further IO/MDS requests\\nimmediately and then evict the kclient itself.\\n\\nThe reason why we still need to evict the kclient just after\\nblocking all the further IOs is that the MDS could revoke the caps\\nfaster.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ceph: lista de bloqueo del kclient cuando se recibe un seguimiento instant\u00e1neo corrupto. Cuando recibimos un seguimiento instant\u00e1neo corrupto, no sabemos qu\u00e9 ha sucedido exactamente en el lado MDS. Y no debemos continuar con el acceso de IO y metadatos a MDS, lo que puede da\u00f1ar u obtener contenidos incorrectos. Este parche simplemente bloquear\u00e1 todas las solicitudes IO/MDS adicionales inmediatamente y luego expulsar\u00e1 al propio kclient. La raz\u00f3n por la que todav\u00eda necesitamos desalojar al kclient justo despu\u00e9s de bloquear todas las IO adicionales es que el MDS podr\u00eda revocar los l\u00edmites m\u00e1s r\u00e1pido.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/ceph/addr.c\",\"fs/ceph/caps.c\",\"fs/ceph/file.c\",\"fs/ceph/mds_client.c\",\"fs/ceph/snap.c\",\"fs/ceph/super.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"9030aaf9bf0a1eee47a154c316c789e959638b0f\",\"lessThan\":\"66ec619e4591f8350f99c5269a7ce160cccc7a7c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9030aaf9bf0a1eee47a154c316c789e959638b0f\",\"lessThan\":\"a68e564adcaa69b0930809fb64d9d5f7d9c32ba9\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/ceph/addr.c\",\"fs/ceph/caps.c\",\"fs/ceph/file.c\",\"fs/ceph/mds_client.c\",\"fs/ceph/snap.c\",\"fs/ceph/super.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.34\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.34\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.13\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-05-21T17:31:40.303033Z\",\"id\":\"CVE-2023-52732\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.6.35\",\"versionEndExcluding\":\"6.1.13\",\"matchCriteriaId\":\"ECDD8C7D-7C0E-412C-98E4-3FC55CE216BD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:2.6.34:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"A3B1BC1D-ED46-4364-A1D9-1FA74182B03A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:2.6.34:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"86D3F64C-3F27-43E0-B0D4-62CE1E1F4EFB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:2.6.34:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"7927713B-5EB0-41EB-86A9-9935775162E0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:2.6.34:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"59037296-3143-4FBB-AFF7-D4FE2C85502F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:2.6.34:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"9CA27FD5-7DBF-4C85-80A9-D523B2E4B033\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:2.6.34:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"9711E333-A8E7-4F4B-BCFD-2023E889651A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:2.6.34:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"E04D3358-973B-42A1-8E08-2E3AE947193C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.2:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"FF501633-2F44-4913-A8EE-B021929F49F6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.2:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"2BDA597B-CAC1-4DF0-86F0-42E142C654E9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.2:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"725C78C9-12CE-406F-ABE8-0813A01D66E8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.2:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"A127C155-689C-4F67-B146-44A57F4BFD85\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.2:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"D34127CC-68F5-4703-A5F6-5006F803E4AE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.2:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"4AB8D555-648E-4F2F-98BD-3E7F45BD12A8\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/66ec619e4591f8350f99c5269a7ce160cccc7a7c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a68e564adcaa69b0930809fb64d9d5f7d9c32ba9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/66ec619e4591f8350f99c5269a7ce160cccc7a7c\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a68e564adcaa69b0930809fb64d9d5f7d9c32ba9\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:57:03+00:00",
      "cve": "CVE-2023-52732",
      "id": "CVE-2023-52732",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "14",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ceph: blocklist the kclient when receiving corrupted snap trace",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-52732.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-25T02:29:38Z",
      "cve": "CVE-2023-52732",
      "id": "CVE-2023-52732",
      "initial_release_date": "2024-05-25T02:58:36Z",
      "product_status:known_affected": "409",
      "product_status:known_not_affected": "72",
      "product_status:recommended": "397",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2023-52732",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-52732.json",
      "version": "51"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/66ec619e4591f8350f99c5269a7ce160cccc7a7c\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/a68e564adcaa69b0930809fb64d9d5f7d9c32ba9\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T23:11:35.612Z\"}}, {\"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-52732\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-05-21T17:31:40.303033Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-23T19:01:25.277Z\"}, \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"title\": \"ceph: blocklist the kclient when receiving corrupted snap trace\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 9.8, \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:N - Corrupted snap traces are delivered in MDS-originated CephFS messages (CEPH_MSG_CLIENT_SNAP, cap IMPORT snaptrace, reply snapblobs) over the TCP messenger path into ceph_update_snap_trace(); a malicious, compromised, or on-path MDS reaches the bug purely with network traffic.\\nAC:L - A malicious MDS can craft an invalid snap trace that fails decode or partially applies realm state; pre-fix callers ignored the error and continued, so the condition is attacker-controlled and reliably repeatable with no race or other luck required.\\nPR:N - Exploitation needs no privileges on the victim client\\u2014the attacking MDS peer requires no local account or capability, matching other CephFS client MDS-message bugs scored PR:N.\\nUI:N - With CephFS already mounted (normal deployment state), the MDS can unilaterally push snap/cap messages (e.g. snapshot ops or reconnect) without any further victim action at exploit time.\\nS:U - Impact stays inside the client kernel and CephFS mount authority; there is no VM escape, IOMMU bypass, or other cross-boundary effect.\\nC:H - Ignored failures leave partially applied, attacker-influenced snap realm state in place, so subsequent reads can return incorrect snapshot/file contents\\u2014including other snaps\\u2019 data on a shared CephFS\\u2014which is a high confidentiality impact under the overestimate rule.\\nI:H - The fix explicitly exists because continuing I/O after a corrupt snap trace can write with wrong snap contexts and corrupt snapshot contents on the OSDs; that is full integrity loss of CephFS snap data.\\nA:H - Real reports show client hangs requiring reboot after corrupt snap traces, and continuing with inconsistent snap state can hit BUG_ON(!i_head_snapc) and related crash paths, so availability impact is High.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"9030aaf9bf0a1eee47a154c316c789e959638b0f\", \"lessThan\": \"66ec619e4591f8350f99c5269a7ce160cccc7a7c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9030aaf9bf0a1eee47a154c316c789e959638b0f\", \"lessThan\": \"a68e564adcaa69b0930809fb64d9d5f7d9c32ba9\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/ceph/addr.c\", \"fs/ceph/caps.c\", \"fs/ceph/file.c\", \"fs/ceph/mds_client.c\", \"fs/ceph/snap.c\", \"fs/ceph/super.h\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.6.34\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"2.6.34\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.1.13\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.2\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/ceph/addr.c\", \"fs/ceph/caps.c\", \"fs/ceph/file.c\", \"fs/ceph/mds_client.c\", \"fs/ceph/snap.c\", \"fs/ceph/super.h\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/66ec619e4591f8350f99c5269a7ce160cccc7a7c\"}, {\"url\": \"https://git.kernel.org/stable/c/a68e564adcaa69b0930809fb64d9d5f7d9c32ba9\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nceph: blocklist the kclient when receiving corrupted snap trace\\n\\nWhen received corrupted snap trace we don\u0027t know what exactly has\\nhappened in MDS side. And we shouldn\u0027t continue IOs and metadatas\\naccess to MDS, which may corrupt or get incorrect contents.\\n\\nThis patch will just block all the further IO/MDS requests\\nimmediately and then evict the kclient itself.\\n\\nThe reason why we still need to evict the kclient just after\\nblocking all the further IOs is that the MDS could revoke the caps\\nfaster.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.13\", \"versionStartIncluding\": \"2.6.34\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.2\", \"versionStartIncluding\": \"2.6.34\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T09:11:08.351Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2023-52732\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T09:11:08.351Z\", \"dateReserved\": \"2024-05-21T15:19:24.232Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-21T15:22:57.926Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.