{"id":"CVE-2022-49770","state":"PUBLISHED","title":"ceph: avoid putting the realm twice when decoding snaps fails","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nceph: avoid putting the realm twice when decoding snaps fails\n\nWhen decoding the snaps fails it maybe leaving the 'first_realm'\nand 'realm' pointing to the same snaprealm memory. And then it'll\nput it twice and could cause random use-after-free, BUG_ON, etc\nissues.","publishedAt":"2025-05-01T14:09:08.173Z","updatedAt":"2026-08-15T12:22:57.784Z","severity":{"score":9.8,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"982d6011bc30a26e8a3d546e0e7fc7db2c255d85","status":"affected","lessThan":"274e4c79a3a2a24fba7cfe0e41113f1138785c37","versionType":"git"},{"version":"982d6011bc30a26e8a3d546e0e7fc7db2c255d85","status":"affected","lessThan":"cb7495fe957526555782ce0723f79ce92a6db22e","versionType":"git"},{"version":"982d6011bc30a26e8a3d546e0e7fc7db2c255d85","status":"affected","lessThan":"044bc6d3c2c0e9090b0841e7b723875756534b45","versionType":"git"},{"version":"982d6011bc30a26e8a3d546e0e7fc7db2c255d85","status":"affected","lessThan":"2f6e2de3a5289004650118b61f138fe7c28e1905","versionType":"git"},{"version":"982d6011bc30a26e8a3d546e0e7fc7db2c255d85","status":"affected","lessThan":"fd879c83e87735ab8f00ef7755752cf0cbae24b2","versionType":"git"},{"version":"982d6011bc30a26e8a3d546e0e7fc7db2c255d85","status":"affected","lessThan":"51884d153f7ec85e18d607b2467820a90e0f4359","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/ceph/snap.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.0","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.0","versionType":"semver"},{"version":"4.19.268","status":"unaffected","lessThanOrEqual":"4.19.*","versionType":"semver"},{"version":"5.4.226","status":"unaffected","lessThanOrEqual":"5.4.*","versionType":"semver"},{"version":"5.10.157","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.81","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.0.10","status":"unaffected","lessThanOrEqual":"6.0.*","versionType":"semver"},{"version":"6.1","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/ceph/snap.c"]}],"references":["https://git.kernel.org/stable/c/274e4c79a3a2a24fba7cfe0e41113f1138785c37","https://git.kernel.org/stable/c/cb7495fe957526555782ce0723f79ce92a6db22e","https://git.kernel.org/stable/c/044bc6d3c2c0e9090b0841e7b723875756534b45","https://git.kernel.org/stable/c/2f6e2de3a5289004650118b61f138fe7c28e1905","https://git.kernel.org/stable/c/fd879c83e87735ab8f00ef7755752cf0cbae24b2","https://git.kernel.org/stable/c/51884d153f7ec85e18d607b2467820a90e0f4359"],"weaknesses":[],"ingestedAt":"2026-10-29T20:05:26.763Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2022/49xxx/CVE-2022-49770.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2022-49770","state":"PUBLISHED","datePublished":"2025-05-01T14:09:08.173Z","dateUpdated":"2026-08-15T12:22:57.784Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2025-04-16T07:17:33.805Z"},"containers":{"cna":{"title":"ceph: avoid putting the realm twice when decoding snaps fails","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nceph: avoid putting the realm twice when decoding snaps fails\n\nWhen decoding the snaps fails it maybe leaving the 'first_realm'\nand 'realm' pointing to the same snaprealm memory. And then it'll\nput it twice and could cause random use-after-free, BUG_ON, etc\nissues."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"982d6011bc30a26e8a3d546e0e7fc7db2c255d85","status":"affected","lessThan":"274e4c79a3a2a24fba7cfe0e41113f1138785c37","versionType":"git"},{"version":"982d6011bc30a26e8a3d546e0e7fc7db2c255d85","status":"affected","lessThan":"cb7495fe957526555782ce0723f79ce92a6db22e","versionType":"git"},{"version":"982d6011bc30a26e8a3d546e0e7fc7db2c255d85","status":"affected","lessThan":"044bc6d3c2c0e9090b0841e7b723875756534b45","versionType":"git"},{"version":"982d6011bc30a26e8a3d546e0e7fc7db2c255d85","status":"affected","lessThan":"2f6e2de3a5289004650118b61f138fe7c28e1905","versionType":"git"},{"version":"982d6011bc30a26e8a3d546e0e7fc7db2c255d85","status":"affected","lessThan":"fd879c83e87735ab8f00ef7755752cf0cbae24b2","versionType":"git"},{"version":"982d6011bc30a26e8a3d546e0e7fc7db2c255d85","status":"affected","lessThan":"51884d153f7ec85e18d607b2467820a90e0f4359","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/ceph/snap.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.0","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.0","versionType":"semver"},{"version":"4.19.268","status":"unaffected","lessThanOrEqual":"4.19.*","versionType":"semver"},{"version":"5.4.226","status":"unaffected","lessThanOrEqual":"5.4.*","versionType":"semver"},{"version":"5.10.157","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.81","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.0.10","status":"unaffected","lessThanOrEqual":"6.0.*","versionType":"semver"},{"version":"6.1","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/ceph/snap.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/274e4c79a3a2a24fba7cfe0e41113f1138785c37"},{"url":"https://git.kernel.org/stable/c/cb7495fe957526555782ce0723f79ce92a6db22e"},{"url":"https://git.kernel.org/stable/c/044bc6d3c2c0e9090b0841e7b723875756534b45"},{"url":"https://git.kernel.org/stable/c/2f6e2de3a5289004650118b61f138fe7c28e1905"},{"url":"https://git.kernel.org/stable/c/fd879c83e87735ab8f00ef7755752cf0cbae24b2"},{"url":"https://git.kernel.org/stable/c/51884d153f7ec85e18d607b2467820a90e0f4359"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL"},"scenarios":[{"lang":"en","value":"AV:N - Corrupted snap traces reach ceph_update_snap_trace() via MDS-originated CephFS messages (CEPH_MSG_CLIENT_SNAP, cap IMPORT snaptrace, reply snapblobs) over the TCP messenger; a malicious, compromised, or on-path MDS triggers the bug with network traffic alone.\nAC:L - A malicious MDS can craft a multi-realm snap trace whose first realm decodes successfully (setting first_realm) and whose subsequent record fails ceph_decode_need, reliably hitting the double-put path with no race or layout dependency.\nPR:N - Exploitation needs no privileges on the victim client—the attacking MDS peer requires no local account or capability, matching other CephFS client MDS-message bugs scored PR:N.\nUI:N - With CephFS already mounted (normal deployment state), the MDS can unilaterally push snap/cap messages during snapshot ops or reconnect without any further victim action at exploit time.\nS:U - Impact stays inside the client kernel and CephFS mount authority; there is no VM escape, IOMMU bypass, or other cross-boundary effect.\nC:H - Double-putting the snap realm frees struct ceph_snap_realm while inodes and hierarchy links retain dangling pointers, yielding a classic heap UAF read primitive over attacker-reclaimable slab memory.\nI:H - The same UAF write path (nref/list updates on a recycled snap_realm, plus later use via get_quota_realm/ceph_get_snap_realm) enables heap corruption and control-flow hijack primitives.\nA:H - Production reports show LIST_POISON GPFs and client hangs requiring reboot after the double-put, and any UAF of this form can oops or panic the kernel."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-15T12:22:57.784Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0","versionEndExcluding":"4.19.268"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0","versionEndExcluding":"5.4.226"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0","versionEndExcluding":"5.10.157"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0","versionEndExcluding":"5.15.81"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0","versionEndExcluding":"6.0.10"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0","versionEndExcluding":"6.1"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}