Insufficiently protected credentials in Ceph - CVE-2020-27781

Vulnerability identifier: #VU53693

CSH Severity: Low

CVSS v4: 7.2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-27781

CWE-ID: CWE-522

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to gain access to credentials of other application users.

The vulnerability exists due to the way credentials sharing is implemented. User credentials can be manipulated and stolen by Native CephFS consumers of OpenStack Manila, resulting in potential privilege escalation. An Open Stack Manila user can request access to a share to an arbitrary cephx user, including existing users. The access key is retrieved via the interface drivers. Then, all users of the requesting OpenStack project can view the access key. This enables the attacker to target any resource that the user has access to. This can be done to even "admin" users, compromising the ceph administrator.

Ceph
Gentoo Linux
openEuler
Fedora
python-ceph-compat
python-rbd
librgw2
librados-devel
python3-ceph-argparse
rbd-fuse
libcephfs2
rbd-mirror
librbd1
rbd-nbd
python3-rados
librados2
ceph-radosgw
ceph-debugsource
python-cephfs
ceph-mon
ceph-common
librgw-devel
ceph-mds
ceph-osd
librbd-devel
ceph
ceph-fuse
rados-objclass-devel
python-rados
ceph-test
ceph-base
python3-cephfs
ceph-debuginfo
python3-rgw
libradosstriper-devel
ceph-resource-agents
python-rgw
libcephfs-devel
ceph-mgr
ceph-selinux
python3-rbd
libradosstriper1

Install updates from vendor's website.

Ceph - addressed in versions 14.2.16, 15.2.8, 16.2.0
python-ceph-compat - update to 12.2.8-15
python-rbd - update to 12.2.8-15
librgw2 - update to 12.2.8-15
librados-devel - update to 12.2.8-15
python3-ceph-argparse - update to 12.2.8-15
rbd-fuse - update to 12.2.8-15
libcephfs2 - update to 12.2.8-15
rbd-mirror - update to 12.2.8-15
librbd1 - update to 12.2.8-15
rbd-nbd - update to 12.2.8-15
python3-rados - update to 12.2.8-15
librados2 - update to 12.2.8-15
ceph-radosgw - update to 12.2.8-15
ceph-debugsource - update to 12.2.8-15
python-cephfs - update to 12.2.8-15
ceph-mon - update to 12.2.8-15
ceph-common - update to 12.2.8-15
librgw-devel - update to 12.2.8-15
ceph-mds - update to 12.2.8-15
ceph-osd - update to 12.2.8-15
librbd-devel - update to 12.2.8-15
ceph - update to 12.2.8-15
ceph-fuse - update to 12.2.8-15
rados-objclass-devel - update to 12.2.8-15
python-rados - update to 12.2.8-15
ceph-test - update to 12.2.8-15
ceph-base - update to 12.2.8-15
python3-cephfs - update to 12.2.8-15
ceph-debuginfo - update to 12.2.8-15
python3-rgw - update to 12.2.8-15
libradosstriper-devel - update to 12.2.8-15
ceph-resource-agents - update to 12.2.8-15
python-rgw - update to 12.2.8-15
libcephfs-devel - update to 12.2.8-15
ceph-mgr - update to 12.2.8-15
ceph-selinux - update to 12.2.8-15
python3-rbd - update to 12.2.8-15
libradosstriper1 - update to 12.2.8-15
ceph - update to 15.2.8-1.fc33

• https://bugzilla.redhat.com/show_bug.cgi?id=1900109
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZJ7FFROL25FYRL6FMI33VRKOD74LINRP/
• https://security.gentoo.org/glsa/202105-39

• Credentials disclosure in Ceph
• Gentoo update for Ceph
• Fedora 33 update for ceph
• openEuler update for ceph