Security restrictions bypass in Ceph - CVE-2018-10861

Vulnerability identifier: #VU14329

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-10861

CWE-ID: CWE-20

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows an adjacent authenticated attacker to bypass security restrictions on the target system.

The vulnerability exists in ceph branches master, mimic, luminous and jewel due to improper handling of user-supplied requests by ceph mon. An adjacent attacker with read access to ceph can delete, create ceph storage pools and corrupt snapshot images.

Ceph
Debian Linux
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for Scientific Computing
Opensuse
Fedora
Red Hat Ceph Storage
cephmetrics (Red Hat package)
nfs-ganesha (Red Hat package)
ceph-ansible (Red Hat package)
ceph

Install update from vendor's website.

Ceph - addressed in versions 10.2.10-28.el7cp, 12.2.4-30.el7cp
Red Hat Ceph Storage - addressed in versions 2.5, 3
cephmetrics (Red Hat package) - update to 1.0.1-1.el7cp
nfs-ganesha (Red Hat package) - update to 2.5.5-6.el7cp
ceph-ansible (Red Hat package) - update to 3.0.39-1.el7cp
ceph - addressed in versions 12.2.6-1.fc27, 12.2.6-1.fc28, 12.2.7-1.fc27

• https://access.redhat.com/security/cve/cve-2018-10861

• Multiple vulnerabilities in ceph
• Debian update for ceph
• OpenSUSE Linux update for ceph
• OpenSUSE Linux update for ceph
• Red Hat Ceph Storage 3 update for ceph
• Red Hat Ceph Storage 2 update for ceph
• Fedora 28 update for ceph
• Fedora 27 update for ceph
• Fedora 27 update for ceph
• Multiple vulnerabilities in Red Hat Ceph Storage 3
• Multiple vulnerabilities in Red Hat Ceph Storage 2