Improper Authentication in Ceph - CVE-2021-20288

Vulnerability identifier: #VU53692

CSH Severity: Medium

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-20288

CWE-ID: CWE-287

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an error in authentication flow related to CEPHX_GET_AUTH_SESSION_KEY requests. The application does not check other_keys and allows key reuse. A remote attacker who can request a global_id can exploit the ability of any user to request a global_id previously associated with another user, as ceph does not force the reuse of old keys to generate new ones.

Ceph
Gentoo Linux
SUSE Enterprise Storage
SUSE Linux Enterprise Module for Basesystem
openEuler
Fedora
Red Hat Ceph Storage
ceph-ansible (Red Hat package)
python3-rgw
ceph-common
libcephfs-devel
python3-rados
rbd-nbd
python-cephfs
libradosstriper1
ceph-osd
python-rgw
ceph-mds
ceph-test
python-ceph-compat
rbd-mirror
libradosstriper-devel
ceph-selinux
librgw-devel
libcephfs2
ceph-radosgw
python3-cephfs
rados-objclass-devel
ceph-resource-agents
ceph-fuse
ceph-base
python-rbd
ceph-debugsource
rbd-fuse
python3-ceph-argparse
librgw2
ceph-mgr
librados2
python-rados
ceph-mon
librbd-devel
librbd1
ceph-debuginfo
python3-rbd
ceph
librados-devel
libcephfs2-debuginfo
librbd1-debuginfo
libradospp-devel
librados2-debuginfo
librados-devel-debuginfo
ceph-common-debuginfo
cephadm
rbd-nbd-debuginfo
python3-rgw-debuginfo
python3-rbd-debuginfo
ceph-base-debuginfo
python3-rados-debuginfo
python3-cephfs-debuginfo
python3-ceph-common
librgw2-debuginfo

Install updates from vendor's website.

Ceph - addressed in versions 14.2.20, 15.2.11, 16.2.1, 12.2.12-141.el7cp
ceph-ansible (Red Hat package) - update to 3.2.59-1.el7cp
python3-rgw - update to 12.2.8-22
ceph-common - update to 12.2.8-22
libcephfs-devel - update to 12.2.8-22
python3-rados - update to 12.2.8-22
rbd-nbd - update to 12.2.8-22
python-cephfs - update to 12.2.8-22
libradosstriper1 - update to 12.2.8-22
ceph-osd - update to 12.2.8-22
python-rgw - update to 12.2.8-22
ceph-mds - update to 12.2.8-22
ceph-test - update to 12.2.8-22
python-ceph-compat - update to 12.2.8-22
rbd-mirror - update to 12.2.8-22
libradosstriper-devel - update to 12.2.8-22
ceph-selinux - update to 12.2.8-22
librgw-devel - update to 12.2.8-22
libcephfs2 - update to 12.2.8-22
ceph-radosgw - update to 12.2.8-22
python3-cephfs - update to 12.2.8-22
rados-objclass-devel - update to 12.2.8-22
ceph-resource-agents - update to 12.2.8-22
ceph-fuse - update to 12.2.8-22
ceph-base - update to 12.2.8-22
python-rbd - update to 12.2.8-22
ceph-debugsource - update to 12.2.8-22
rbd-fuse - update to 12.2.8-22
python3-ceph-argparse - update to 12.2.8-22
librgw2 - update to 12.2.8-22
ceph-mgr - update to 12.2.8-22
librados2 - update to 12.2.8-22
python-rados - update to 12.2.8-22
ceph-mon - update to 12.2.8-22
librbd-devel - update to 12.2.8-22
librbd1 - update to 12.2.8-22
ceph-debuginfo - update to 12.2.8-22
python3-rbd - update to 12.2.8-22
ceph - update to 12.2.8-22
librados-devel - update to 12.2.8-22
ceph - addressed in versions 14.2.20-1.fc32, 15.2.11-1.fc33, 16.2.1-1.fc34
libcephfs2-debuginfo - update to 15.2.11.83+g8a15f484c2-3.20.1
librbd1-debuginfo - update to 15.2.11.83+g8a15f484c2-3.20.1
librbd1 - update to 15.2.11.83+g8a15f484c2-3.20.1
librbd-devel - update to 15.2.11.83+g8a15f484c2-3.20.1
libradospp-devel - update to 15.2.11.83+g8a15f484c2-3.20.1
librados2-debuginfo - update to 15.2.11.83+g8a15f484c2-3.20.1
librados2 - update to 15.2.11.83+g8a15f484c2-3.20.1
librados-devel-debuginfo - update to 15.2.11.83+g8a15f484c2-3.20.1
librados-devel - update to 15.2.11.83+g8a15f484c2-3.20.1
librgw-devel - update to 15.2.11.83+g8a15f484c2-3.20.1
libcephfs2 - update to 15.2.11.83+g8a15f484c2-3.20.1
libcephfs-devel - update to 15.2.11.83+g8a15f484c2-3.20.1
ceph-debugsource - update to 15.2.11.83+g8a15f484c2-3.20.1
ceph-common-debuginfo - update to 15.2.11.83+g8a15f484c2-3.20.1
ceph-common - update to 15.2.11.83+g8a15f484c2-3.20.1
cephadm - update to 15.2.11.83+g8a15f484c2-3.20.1
python3-rbd - update to 15.2.11.83+g8a15f484c2-3.20.1
ceph-base - update to 15.2.11.83+g8a15f484c2-3.20.1
rbd-nbd-debuginfo - update to 15.2.11.83+g8a15f484c2-3.20.1
rbd-nbd - update to 15.2.11.83+g8a15f484c2-3.20.1
rados-objclass-devel - update to 15.2.11.83+g8a15f484c2-3.20.1
python3-rgw-debuginfo - update to 15.2.11.83+g8a15f484c2-3.20.1
python3-rgw - update to 15.2.11.83+g8a15f484c2-3.20.1
python3-rbd-debuginfo - update to 15.2.11.83+g8a15f484c2-3.20.1
ceph-base-debuginfo - update to 15.2.11.83+g8a15f484c2-3.20.1
python3-rados-debuginfo - update to 15.2.11.83+g8a15f484c2-3.20.1
python3-rados - update to 15.2.11.83+g8a15f484c2-3.20.1
python3-cephfs-debuginfo - update to 15.2.11.83+g8a15f484c2-3.20.1
python3-cephfs - update to 15.2.11.83+g8a15f484c2-3.20.1
python3-ceph-common - update to 15.2.11.83+g8a15f484c2-3.20.1
python3-ceph-argparse - update to 15.2.11.83+g8a15f484c2-3.20.1
librgw2-debuginfo - update to 15.2.11.83+g8a15f484c2-3.20.1
librgw2 - update to 15.2.11.83+g8a15f484c2-3.20.1

• https://bugzilla.redhat.com/show_bug.cgi?id=1938031
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/362CEPPYF3YMJZBEJQUT3KDE2EHYYIYQ/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5BPIAYTRCWAU4XWCDBK2THEFVXSC4XGK/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JVWUKUUS5BCIFWRV3JCUQMAPJ4HIWSED/
• https://security.gentoo.org/glsa/202105-39

• Improper authentication in Ceph
• Gentoo update for Ceph
• Authentication bypass in Red Hat Ceph Storage
• SUSE update for ceph
• openEuler update for ceph
• Fedora 34 update for ceph
• Fedora 33 update for ceph
• Fedora 32 update for ceph