Security readout for executives and security teams
Plain-English summary
A Linux Ceph filesystem flaw can mishandle memory when snapshot information fails to decode. The same object may be released twice, potentially causing crashes, kernel failures, or use-after-free behavior. The supplied CVSS rating is 9.8, but exposure depends on using the affected kernel Ceph functionality.
Executive priority
Treat as urgent for environments using kernel-based Ceph, especially production storage clients. Rapidly establish actual Ceph usage and vendor patch status before assuming fleet-wide exposure. Systems without this functionality are less likely to be affected based on the described code path.
Technical view
During failed Ceph snapshot decoding, first_realm and realm may reference the same snaprealm. Cleanup can then decrement or release that object twice, producing a use-after-free, BUG_ON, or other unpredictable kernel behavior. Six Linux stable-tree commits are cited as fixes.
Likely exposure
Prioritize Linux systems using kernel Ceph filesystem functionality, particularly snapshot handling. The bundle marks several kernel versions from 4.0 through 6.1 as affected, but its version data is ambiguous; confirm exact vulnerable and fixed builds with the kernel or distribution vendor.
Exploitation context
CISA KEV status is false, and the supplied sources provide no evidence of active exploitation or a public exploit. Although the supplied CVSS vector describes network-reachable, unauthenticated impact, the bundle does not establish practical attack prerequisites or reliable remote exploitation.
Researcher notes
The failure occurs in cleanup after snapshot decoding errors, where aliasing between first_realm and realm can cause a double put. The sources identify possible use-after-free and BUG_ON outcomes but do not document reproducibility, attacker-controlled inputs, exploitation reliability, or observed attacks.
Mitigation direction
- Install a supported vendor kernel containing the CVE-2022-49770 Ceph fix.
- Reboot affected systems into the updated kernel and confirm the running version.
- Prioritize Ceph clients processing snapshots or untrusted Ceph metadata.
- If immediate patching is impossible, consult vendor guidance for supported exposure-reduction measures.
Validation and detection
- Inventory running kernel versions across systems using Ceph filesystem functionality.
- Confirm whether the kernel Ceph client and snapshot features are actively used.
- Map vendor kernel builds to the cited stable-tree fixes or vendor advisories.
- After updating, verify systems booted into the remediated kernel.
- Review kernel logs for Ceph-related use-after-free, BUG_ON, or unexplained crashes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-49770 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9LinuxVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/274e4c79a3a2a24fba7cfe0e41113f1138785c37CVE reference, Linux
- https://git.kernel.org/stable/c/cb7495fe957526555782ce0723f79ce92a6db22eCVE reference, Linux
- https://git.kernel.org/stable/c/044bc6d3c2c0e9090b0841e7b723875756534b45CVE reference, Linux
- https://git.kernel.org/stable/c/2f6e2de3a5289004650118b61f138fe7c28e1905CVE reference, Linux
- https://git.kernel.org/stable/c/fd879c83e87735ab8f00ef7755752cf0cbae24b2CVE reference, Linux
- https://git.kernel.org/stable/c/51884d153f7ec85e18d607b2467820a90e0f4359CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.