CVE-2025-40362 (GCVE-0-2025-40362)

Vulnerability from cvelistv5 – Published: 2025-12-16 13:40 – Updated: 2026-01-02 15:33
VLAI?
Title
ceph: fix multifs mds auth caps issue
Summary
In the Linux kernel, the following vulnerability has been resolved: ceph: fix multifs mds auth caps issue The mds auth caps check should also validate the fsname along with the associated caps. Not doing so would result in applying the mds auth caps of one fs on to the other fs in a multifs ceph cluster. The bug causes multiple issues w.r.t user authentication, following is one such example. Steps to Reproduce (on vstart cluster): 1. Create two file systems in a cluster, say 'fsname1' and 'fsname2' 2. Authorize read only permission to the user 'client.usr' on fs 'fsname1' $ceph fs authorize fsname1 client.usr / r 3. Authorize read and write permission to the same user 'client.usr' on fs 'fsname2' $ceph fs authorize fsname2 client.usr / rw 4. Update the keyring $ceph auth get client.usr >> ./keyring With above permssions for the user 'client.usr', following is the expectation. a. The 'client.usr' should be able to only read the contents and not allowed to create or delete files on file system 'fsname1'. b. The 'client.usr' should be able to read/write on file system 'fsname2'. But, with this bug, the 'client.usr' is allowed to read/write on file system 'fsname1'. See below. 5. Mount the file system 'fsname1' with the user 'client.usr' $sudo bin/mount.ceph usr@.fsname1=/ /kmnt_fsname1_usr/ 6. Try creating a file on file system 'fsname1' with user 'client.usr'. This should fail but passes with this bug. $touch /kmnt_fsname1_usr/file1 7. Mount the file system 'fsname1' with the user 'client.admin' and create a file. $sudo bin/mount.ceph admin@.fsname1=/ /kmnt_fsname1_admin $echo "data" > /kmnt_fsname1_admin/admin_file1 8. Try removing an existing file on file system 'fsname1' with the user 'client.usr'. This shoudn't succeed but succeeds with the bug. $rm -f /kmnt_fsname1_usr/admin_file1 For more information, please take a look at the corresponding mds/fuse patch and tests added by looking into the tracker mentioned below. v2: Fix a possible null dereference in doutc v3: Don't store fsname from mdsmap, validate against ceph_mount_options's fsname and use it v4: Code refactor, better warning message and fix possible compiler warning [ Slava.Dubeyko: "fsname check failed" -> "fsname mismatch" ]
Severity ?
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 596afb0b8933ba6ed7227adcc538db26feb25c74 , < 07640d34a781bb2e39020a39137073c03c4aa932 (git)
Affected: 596afb0b8933ba6ed7227adcc538db26feb25c74 , < ca3da8b27ab9a0923ad477447cfb8fc7f4b4c523 (git)
Affected: 596afb0b8933ba6ed7227adcc538db26feb25c74 , < 22c73d52a6d05c5a2053385c0d6cd9984732799d (git)
Create a notification for this product.
    Linux Linux Affected: 6.10
Unaffected: 0 , < 6.10 (semver)
Unaffected: 6.12.58 , ≤ 6.12.* (semver)
Unaffected: 6.17.8 , ≤ 6.17.* (semver)
Unaffected: 6.18 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ceph/mds_client.c",
            "fs/ceph/mdsmap.c",
            "fs/ceph/super.c",
            "fs/ceph/super.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "07640d34a781bb2e39020a39137073c03c4aa932",
              "status": "affected",
              "version": "596afb0b8933ba6ed7227adcc538db26feb25c74",
              "versionType": "git"
            },
            {
              "lessThan": "ca3da8b27ab9a0923ad477447cfb8fc7f4b4c523",
              "status": "affected",
              "version": "596afb0b8933ba6ed7227adcc538db26feb25c74",
              "versionType": "git"
            },
            {
              "lessThan": "22c73d52a6d05c5a2053385c0d6cd9984732799d",
              "status": "affected",
              "version": "596afb0b8933ba6ed7227adcc538db26feb25c74",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ceph/mds_client.c",
            "fs/ceph/mdsmap.c",
            "fs/ceph/super.c",
            "fs/ceph/super.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "lessThan": "6.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.58",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.58",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.8",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nceph: fix multifs mds auth caps issue\n\nThe mds auth caps check should also validate the\nfsname along with the associated caps. Not doing\nso would result in applying the mds auth caps of\none fs on to the other fs in a multifs ceph cluster.\nThe bug causes multiple issues w.r.t user\nauthentication, following is one such example.\n\nSteps to Reproduce (on vstart cluster):\n1. Create two file systems in a cluster, say \u0027fsname1\u0027 and \u0027fsname2\u0027\n2. Authorize read only permission to the user \u0027client.usr\u0027 on fs \u0027fsname1\u0027\n    $ceph fs authorize fsname1 client.usr / r\n3. Authorize read and write permission to the same user \u0027client.usr\u0027 on fs \u0027fsname2\u0027\n    $ceph fs authorize fsname2 client.usr / rw\n4. Update the keyring\n    $ceph auth get client.usr \u003e\u003e ./keyring\n\nWith above permssions for the user \u0027client.usr\u0027, following is the\nexpectation.\n  a. The \u0027client.usr\u0027 should be able to only read the contents\n     and not allowed to create or delete files on file system \u0027fsname1\u0027.\n  b. The \u0027client.usr\u0027 should be able to read/write on file system \u0027fsname2\u0027.\n\nBut, with this bug, the \u0027client.usr\u0027 is allowed to read/write on file\nsystem \u0027fsname1\u0027. See below.\n\n5. Mount the file system \u0027fsname1\u0027 with the user \u0027client.usr\u0027\n     $sudo bin/mount.ceph usr@.fsname1=/ /kmnt_fsname1_usr/\n6. Try creating a file on file system \u0027fsname1\u0027 with user \u0027client.usr\u0027. This\n   should fail but passes with this bug.\n     $touch /kmnt_fsname1_usr/file1\n7. Mount the file system \u0027fsname1\u0027 with the user \u0027client.admin\u0027 and create a\n   file.\n     $sudo bin/mount.ceph admin@.fsname1=/ /kmnt_fsname1_admin\n     $echo \"data\" \u003e /kmnt_fsname1_admin/admin_file1\n8. Try removing an existing file on file system \u0027fsname1\u0027 with the user\n   \u0027client.usr\u0027. This shoudn\u0027t succeed but succeeds with the bug.\n     $rm -f /kmnt_fsname1_usr/admin_file1\n\nFor more information, please take a look at the corresponding mds/fuse patch\nand tests added by looking into the tracker mentioned below.\n\nv2: Fix a possible null dereference in doutc\nv3: Don\u0027t store fsname from mdsmap, validate against\n    ceph_mount_options\u0027s fsname and use it\nv4: Code refactor, better warning message and\n    fix possible compiler warning\n\n[ Slava.Dubeyko: \"fsname check failed\" -\u003e \"fsname mismatch\" ]"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-02T15:33:55.723Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/07640d34a781bb2e39020a39137073c03c4aa932"
        },
        {
          "url": "https://git.kernel.org/stable/c/ca3da8b27ab9a0923ad477447cfb8fc7f4b4c523"
        },
        {
          "url": "https://git.kernel.org/stable/c/22c73d52a6d05c5a2053385c0d6cd9984732799d"
        }
      ],
      "title": "ceph: fix multifs mds auth caps issue",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40362",
    "datePublished": "2025-12-16T13:40:02.467Z",
    "dateReserved": "2025-04-16T07:20:57.187Z",
    "dateUpdated": "2026-01-02T15:33:55.723Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-40362\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-12-16T14:15:48.217\",\"lastModified\":\"2025-12-18T15:08:25.907\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nceph: fix multifs mds auth caps issue\\n\\nThe mds auth caps check should also validate the\\nfsname along with the associated caps. Not doing\\nso would result in applying the mds auth caps of\\none fs on to the other fs in a multifs ceph cluster.\\nThe bug causes multiple issues w.r.t user\\nauthentication, following is one such example.\\n\\nSteps to Reproduce (on vstart cluster):\\n1. Create two file systems in a cluster, say \u0027fsname1\u0027 and \u0027fsname2\u0027\\n2. Authorize read only permission to the user \u0027client.usr\u0027 on fs \u0027fsname1\u0027\\n    $ceph fs authorize fsname1 client.usr / r\\n3. Authorize read and write permission to the same user \u0027client.usr\u0027 on fs \u0027fsname2\u0027\\n    $ceph fs authorize fsname2 client.usr / rw\\n4. Update the keyring\\n    $ceph auth get client.usr \u003e\u003e ./keyring\\n\\nWith above permssions for the user \u0027client.usr\u0027, following is the\\nexpectation.\\n  a. The \u0027client.usr\u0027 should be able to only read the contents\\n     and not allowed to create or delete files on file system \u0027fsname1\u0027.\\n  b. The \u0027client.usr\u0027 should be able to read/write on file system \u0027fsname2\u0027.\\n\\nBut, with this bug, the \u0027client.usr\u0027 is allowed to read/write on file\\nsystem \u0027fsname1\u0027. See below.\\n\\n5. Mount the file system \u0027fsname1\u0027 with the user \u0027client.usr\u0027\\n     $sudo bin/mount.ceph usr@.fsname1=/ /kmnt_fsname1_usr/\\n6. Try creating a file on file system \u0027fsname1\u0027 with user \u0027client.usr\u0027. This\\n   should fail but passes with this bug.\\n     $touch /kmnt_fsname1_usr/file1\\n7. Mount the file system \u0027fsname1\u0027 with the user \u0027client.admin\u0027 and create a\\n   file.\\n     $sudo bin/mount.ceph admin@.fsname1=/ /kmnt_fsname1_admin\\n     $echo \\\"data\\\" \u003e /kmnt_fsname1_admin/admin_file1\\n8. Try removing an existing file on file system \u0027fsname1\u0027 with the user\\n   \u0027client.usr\u0027. This shoudn\u0027t succeed but succeeds with the bug.\\n     $rm -f /kmnt_fsname1_usr/admin_file1\\n\\nFor more information, please take a look at the corresponding mds/fuse patch\\nand tests added by looking into the tracker mentioned below.\\n\\nv2: Fix a possible null dereference in doutc\\nv3: Don\u0027t store fsname from mdsmap, validate against\\n    ceph_mount_options\u0027s fsname and use it\\nv4: Code refactor, better warning message and\\n    fix possible compiler warning\\n\\n[ Slava.Dubeyko: \\\"fsname check failed\\\" -\u003e \\\"fsname mismatch\\\" ]\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/07640d34a781bb2e39020a39137073c03c4aa932\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/22c73d52a6d05c5a2053385c0d6cd9984732799d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ca3da8b27ab9a0923ad477447cfb8fc7f4b4c523\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.