Threats Tagged 'ghsa-vqxr-6xh4-gccq'

A vulnerability in the Linux kernel's Ceph client was resolved involving improper bounds checking during decoding of MDSCapAuth path and fs_name fields in handle_session(). This flaw allows a malicious or compromised MDS to cause an out-of-bounds read of up to 4 GiB past the allocated message buffer during session setup, potentially crashing the client kernel. The issue arises because two fields are decoded without proper bounds checks, unlike other fields. The fix involved switching to safe decode functions that enforce bounds checking and handle errors gracefully.