CVE-2022-48767

What it actually does

Reference leak in ceph try_prep_async_create path causes ceph_string objects to never be released after failed or completed async create operations.

Why it matters to the business

Systems using Ceph may experience gradual memory growth over time leading to resource pressure or instability in long-running storage workloads.

How an attack unfolds

An attacker with the ability to trigger repeated ceph async create operations can cause unbounded reference counts to accumulate without corresponding decrements, exhausting kernel memory.

How to fix it

Update the Linux kernel to the fixed commit e7be12ca7d3947765b0d7c1c7e0537e748da993a or later stable release containing the proper ceph_string_put call after try_prep_async_create.

How to confirm the fix worked

Inspect the ceph code for the presence of the ceph_string_put after the async create attempt; confirm the commit hash is present in the running kernel source or binary.

Typical attack path

1. Obtain access or trigger paths that invoke ceph async create operations
2. Repeatedly exercise the faulty code path to leak ceph_string references
3. Monitor for kernel memory growth until system impact occurs

How to detect it

Review kernel memory statistics and slab allocator usage for ceph_string objects over extended periods; correlate with Ceph async create activity in system logs.

What your security team should do

• Prioritize kernel updates on all Ceph client and server systems
• Monitor memory usage trends on Ceph nodes for unexplained growth
• Review Ceph usage patterns that may exercise async create paths