CVE-2023-52636

What it actually does

Short socket reads of a Ceph message footer cause read_partial_sparse_msg_data() to invoke the OSD client state machine instead of bailing; the sparse-read handler then treats footer bytes as a header, producing bogus extent counts and data lengths.

Why it matters to the business

Ceph storage clusters on affected kernels may experience OSD crashes, incorrect I/O handling, or degraded availability when network reads are fragmented, increasing operational risk for storage-dependent workloads.

How an attack unfolds

An attacker able to send Ceph messenger traffic can induce short reads on the socket; when the messenger later resumes, the flawed sparse-read path misinterprets footer data, causing the OSD client to process invalid lengths and potentially panic or corrupt state.

How to fix it

Upgrade the Linux kernel to a version containing commit da9c33a70f095d5d55c36d0bfeba969e31de08ae (or later stable backports) in the libceph module.

How to confirm the fix worked

Confirm the kernel source contains the referenced commit; verify that cursor->total_resid is checked before calling into osd_sparse_read() on partial footer reads; test with fragmented socket reads under Ceph OSD load.

Typical attack path

1. Establish or observe a Ceph messenger connection carrying sparse-read operations
2. Force a short read of the message footer bytes
3. Trigger the next socket-ready event so read_partial_sparse_msg_data() is invoked
4. Observe or induce OSD client state machine entry with footer interpreted as sparse header
5. Cause invalid extent/data length calculation leading to crash or misbehavior

How to detect it

Review kernel logs for Ceph OSD client panics or warnings referencing read_partial_sparse_msg_data or sparse-read header parsing; correlate with Ceph messenger socket activity around the time of the event.

What your security team should do

• Prioritize kernel updates on all Ceph OSD and client nodes within the next maintenance window
• Monitor Ceph cluster health dashboards for OSD restarts or I/O errors after patching
• Apply network-level segmentation to limit exposure of Ceph public networks until patches are deployed