CyberRota Analysis
AI-GeneratedThe vulnerability affects the Linux kernel's Ceph client, specifically in the handling of sparse-read requests, where it fails to properly validate the monotonicity and boundaries of OSD-supplied extent maps. This oversight allows a malicious or compromised authenticated Ceph OSD peer to send a malformed reply that can crash the kernel client by advancing the data cursor beyond the intended request buffer. Organizations using the Linux kernel with Ceph should prioritize this issue to prevent potential disruptions caused by compromised OSD interactions.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: libceph: validate OSD extent maps before cursor advance net/ceph/osd_client.c:osd_sparse_read() validates that the sparse-read data length matches the summed extent lengths, but it does not validate that each OSD-supplied extent is monotonic and lies inside the original request range. A malformed authenticated OSD reply can advertise a far-forward nonzero extent offset with a matching data length and make the client advance the message-data cursor beyond the request buffer. This reaches the BUG_ON(!*length) assertion in ceph_msg_data_next() from the client receive path. Impact: A malicious or compromised authenticated Ceph OSD peer can crash a kernel Ceph client via a malformed sparse-read reply. Reject sparse extent maps that overflow, move backwards, overlap, or extend outside the original sparse-read request before advancing the cursor. [ idryomov: perform sparse_extent_map_valid() check a bit earlier, in CEPH_SPARSE_READ_DATA_LEN instead of CEPH_SPARSE_READ_DATA_PRE state ]