Description

In the Linux kernel, the following vulnerability has been resolved: ceph: bound xattr value length in __build_xattrs() __build_xattrs() decodes the MDS-supplied xattr blob one attribute at a time. For each attribute it reads a 32-bit name length, advances past the name bytes, reads a 32-bit value length, records the value pointer, and advances past the value bytes. The two length fields are read with ceph_decode_32_safe(), but the value bytes themselves are advanced over with a bare "p += len" and no ceph_decode_need() check that "len" bytes remain in the blob. For every attribute except the last, the next iteration's ceph_decode_32_safe() on the following name length implicitly verifies that the previous value did not run past the blob end. The final attribute has no successor, so its decoded value length is never checked against the blob bounds. A malicious or compromised metadata server can set the last attribute's value length larger than the bytes actually present in the blob. The blob is a dedicated kvmalloc() allocation sized to the wire length (ceph_buffer_new() in ceph_fill_inode()). __set_xattr() records the oversized length in xattr->val_len verbatim, and a later getxattr(2) runs memcpy(value, xattr->val, xattr->val_len) into a user-supplied buffer, copying bytes past the end of the allocation back to user space. Impact: a malicious metadata server discloses adjacent kernel heap bytes to a local user via getxattr(2) on a CephFS file. Add the missing ceph_decode_need() so an out-of-bounds value length on the final attribute fails the decode and returns -EIO instead of being stored.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-09-11T20:19:50.897Z",
  "pubdate": "2026-09-11T20:19:50.897Z",
  "executiveSummary": "This vulnerability is an out-of-bounds (OOB) memory read vulnerability located within the Linux kernel's Ceph filesystem client.\nThe issue stems from insufficient bounds checking when parsing extended attributes (xattrs) provided by a Metadata Server (MDS).\nA malicious or compromised MDS can manipulate the length field of the final xattr entry, causing the kernel to read past the allocated buffer bounds.\nSuccessful exploitation allows an attacker to disclose sensitive adjacent kernel heap memory to a local user via the getxattr(2) system call.\nThe vulnerability affects Linux kernel systems utilizing the CephFS client implementation.\nRisk is significant, as it provides a mechanism for an attacker to extract arbitrary kernel heap data, potentially leaking cryptographic keys, pointers, or other sensitive kernel structures.\nExploitation requires the client to interact with a malicious Ceph MDS, which could be achieved through a man-in-the-middle attack or a compromised storage infrastructure.",
  "technicalDetails": "The root cause of the vulnerability resides in the __build_xattrs() function, which is responsible for decoding the xattr blob supplied by the Ceph MDS.\nDuring the decoding process, the function iterates through xattrs, reading the name length and value length using ceph_decode_32_safe(). However, while the name length is validated, the value bytes are skipped using a raw pointer increment ('p += len') without an accompanying ceph_decode_need() check to ensure the length remains within the bounds of the allocated buffer.\nFor all attributes except the final one, the iteration process provides an implicit bounds check because the next call to ceph_decode_32_safe() for the subsequent name length acts as a boundary verification.\nFor the final xattr in the blob, no such successor exists. Consequently, if an MDS provides a maliciously large value length for the last attribute, the function fails to verify that the value resides within the allocated memory segment.\nThe blob is stored in a heap-allocated buffer generated by ceph_buffer_new() within ceph_fill_inode(). The function __set_xattr() stores the attacker-supplied, oversized 'val_len' directly into the inode's xattr structure.\nWhen a local user invokes the getxattr(2) system call on the affected file, the kernel executes a memcpy() operation from the corrupted xattr->val pointer into a user-supplied buffer using the oversized length.\nBecause the length exceeds the actual valid data in the buffer, the memcpy() operation reads beyond the boundary of the original kvmalloc() allocation, effectively copying adjacent kernel heap bytes into the user-space buffer.\nThis behavior facilitates the leakage of sensitive internal kernel heap contents. The attack does not require complex heap grooming, as the vulnerability directly relies on the MDS providing malformed metadata to the kernel client during the directory entry or inode initialization phase."
}