CephFS/RBD kernel client (libceph messenger v2): A signedness bug in net/ceph/messenger_v2.c turns an attacker-chosen

Impact

A signedness bug in net/ceph/messenger_v2.c turns an attacker-chosen frame length into a buffer overflow inside the kernel, reachable through HELLO and other early control frames. That is remote code execution in kernel context on every node that mounts CephFS or maps RBD.

Who can reach it

Anything that can complete or spoof the start of a messenger v2 handshake with a client node - a rogue mon/OSD, or an attacker on the storage network able to answer a client's connection.

What to do

Update to Linux 6.4.5 or later (or a vendor kernel with the backport) on all Ceph client nodes and reboot. Restrict which hosts can reach client nodes on the Ceph ports and keep the storage fabric off tenant-routable networks.

References