CVE-2023-52583

What it actually does

Incorrect lock ordering between a dentry and its parent in the ceph filesystem could allow a local process to trigger a deadlock or invoke unreachable deadcode paths during directory operations.

Why it matters to the business

Systems running affected Linux kernels with ceph may experience unexpected unresponsiveness or crashes when local users interact with ceph-mounted directories, increasing operational risk for storage-dependent workloads; the issue has been present for years with low but non-zero exploitability signals and requires kernel updates across many distributions.

How an attack unfolds

An attacker with local access invokes ceph directory operations that misuse dget() on a dentry before its parent is locked, violating the required parent-first locking order and potentially causing the kernel to hang or follow the deadcode path; no named threat actors have publicly exploited this specific flaw.

How to fix it

Update to a fixed kernel containing commit eb55ba8aa7fb7aad54f40fbf4d8dcdfdba0bebf6 or later; for affected Ubuntu packages upgrade aria2 to the versions listed (1.18.1-1ubuntu0.1~esm1 for 14.04, 1.19.0-1ubuntu0.1~esm1 for 16.04, 1.33.1-1ubuntu0.1~esm1 for 18.04, 1.34.0-4 for 20.04) and reboot.

How to confirm the fix worked

Confirm the running kernel includes commit eb55ba8aa7fb7aad54f40fbf4d8dcdfdba0bebf6 or a backport that removes the dead dget() usage; verify package versions match the fixed releases and test ceph directory operations under load to ensure no deadlock occurs.

Typical attack path

1. Obtain local user access on a system with ceph filesystem mounted
2. Trigger directory creation, lookup, or attribute operations that reach the misordered dget() call site
3. Force concurrent access patterns that expose the incorrect lock ordering between child dentry and parent
4. Observe kernel hang or crash due to deadlock or attempted execution of deadcode

How to detect it

Review kernel logs for ceph-related deadlock warnings or hung task messages around directory operations; examine audit logs for unusual local process activity on ceph mounts; no public indicators of active exploitation have been observed.

What your security team should do

• Prioritize kernel updates on all systems using ceph filesystems within the next 30 days
• Audit local ceph mount usage and restrict untrusted local accounts where possible
• Monitor vendor advisories for additional backported fixes in distribution kernels
• After patching, validate with targeted filesystem stress tests before returning systems to production