Resource exhaustion in Storage Ceph - CVE-2023-46159

Vulnerability identifier: #VU85833

CSH Severity: Low

CVSS v4: 2.1 [CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-46159

CWE-ID: CWE-400

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows a user in adjacent network to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources. A user in adjacent network can trigger resource exhaustion and perform a denial of service (DoS) attack from RGW.

Storage Ceph
Storage Fusion Data Foundation
Red Hat Ceph Storage
Red Hat Enterprise Linux for x86_64
openEuler
haproxy (Red Hat package)
oath-toolkit (Red Hat package)
cephadm-ansible (Red Hat package)
ceph-ansible (Red Hat package)
ceph-osd
ceph
librados2
librados-devel
libcephfs2
libcephfs-devel
ceph-test
ceph-selinux
ceph-resource-agents
ceph-radosgw
ceph-mon
ceph-mgr
ceph-mds
ceph-fuse
ceph-debugsource
ceph-debuginfo
ceph-common
ceph-base
libradosstriper-devel
python-rgw
rbd-nbd
rbd-mirror
rbd-fuse
rados-objclass-devel
python3-rgw
python3-rbd
python3-rados
python3-cephfs
python3-ceph-argparse
libradosstriper1
python-rbd
python-rados
python-cephfs
python-ceph-compat
librgw2
librgw-devel
librbd1
librbd-devel
libradospp-devel
libcephsqlite-devel
libcephsqlite
cephfs-mirror
ceph-immutable-object-cache
cephfs-top
cephadm
ceph-prometheus-alerts
ceph-mgr-rook
ceph-mgr-modules-core
ceph-mgr-k8sevents
ceph-mgr-diskprediction-local
ceph-mgr-dashboard
ceph-mgr-cephadm
ceph-grafana-dashboards
python3-ceph-common
ceph (Red Hat package)
Ceph

Install updates from vendor's website.

Storage Ceph - update to 6.1z2
Red Hat Ceph Storage - update to 8.1
haproxy (Red Hat package) - update to 2.2.19-5.el8cp
oath-toolkit (Red Hat package) - update to 2.6.12-1.el9cp
cephadm-ansible (Red Hat package) - update to 4.1.4-1.el9cp
ceph-ansible (Red Hat package) - update to 6.0.28.7-1.el8cp
ceph-osd - addressed in versions 12.2.8-25, 16.2.7-21
ceph - addressed in versions 12.2.8-25, 16.2.7-21
librados2 - addressed in versions 12.2.8-25, 16.2.7-21
librados-devel - addressed in versions 12.2.8-25, 16.2.7-21
libcephfs2 - addressed in versions 12.2.8-25, 16.2.7-21
libcephfs-devel - addressed in versions 12.2.8-25, 16.2.7-21
ceph-test - addressed in versions 12.2.8-25, 16.2.7-21
ceph-selinux - addressed in versions 12.2.8-25, 16.2.7-21
ceph-resource-agents - addressed in versions 12.2.8-25, 16.2.7-21
ceph-radosgw - addressed in versions 12.2.8-25, 16.2.7-21
ceph-mon - addressed in versions 12.2.8-25, 16.2.7-21
ceph-mgr - addressed in versions 12.2.8-25, 16.2.7-21
ceph-mds - addressed in versions 12.2.8-25, 16.2.7-21
ceph-fuse - addressed in versions 12.2.8-25, 16.2.7-21
ceph-debugsource - addressed in versions 12.2.8-25, 16.2.7-21
ceph-debuginfo - addressed in versions 12.2.8-25, 16.2.7-21
ceph-common - addressed in versions 12.2.8-25, 16.2.7-21
ceph-base - addressed in versions 12.2.8-25, 16.2.7-21
libradosstriper-devel - addressed in versions 12.2.8-25, 16.2.7-21
python-rgw - update to 12.2.8-25
rbd-nbd - addressed in versions 12.2.8-25, 16.2.7-21
rbd-mirror - addressed in versions 12.2.8-25, 16.2.7-21
rbd-fuse - addressed in versions 12.2.8-25, 16.2.7-21
rados-objclass-devel - addressed in versions 12.2.8-25, 16.2.7-21
python3-rgw - addressed in versions 12.2.8-25, 16.2.7-21
python3-rbd - addressed in versions 12.2.8-25, 16.2.7-21
python3-rados - addressed in versions 12.2.8-25, 16.2.7-21
python3-cephfs - addressed in versions 12.2.8-25, 16.2.7-21
python3-ceph-argparse - addressed in versions 12.2.8-25, 16.2.7-21
libradosstriper1 - addressed in versions 12.2.8-25, 16.2.7-21
python-rbd - update to 12.2.8-25
python-rados - update to 12.2.8-25
python-cephfs - update to 12.2.8-25
python-ceph-compat - update to 12.2.8-25
librgw2 - addressed in versions 12.2.8-25, 16.2.7-21
librgw-devel - addressed in versions 12.2.8-25, 16.2.7-21
librbd1 - addressed in versions 12.2.8-25, 16.2.7-21
librbd-devel - addressed in versions 12.2.8-25, 16.2.7-21
libradospp-devel - update to 16.2.7-21
libcephsqlite-devel - update to 16.2.7-21
libcephsqlite - update to 16.2.7-21
cephfs-mirror - update to 16.2.7-21
ceph-immutable-object-cache - update to 16.2.7-21
cephfs-top - update to 16.2.7-21
cephadm - update to 16.2.7-21
ceph-prometheus-alerts - update to 16.2.7-21
ceph-mgr-rook - update to 16.2.7-21
ceph-mgr-modules-core - update to 16.2.7-21
ceph-mgr-k8sevents - update to 16.2.7-21
ceph-mgr-diskprediction-local - update to 16.2.7-21
ceph-mgr-dashboard - update to 16.2.7-21
ceph-mgr-cephadm - update to 16.2.7-21
ceph-grafana-dashboards - update to 16.2.7-21
python3-ceph-common - update to 16.2.7-21
Ceph - addressed in versions 16.2.10-248.el8cp, 16.2.10-248.el9cp
ceph (Red Hat package) - update to 19.2.1-222.el9cp

• https://www.ibm.com/support/pages/node/7109101

• Resource exhaustion in IBM Storage Ceph
• Multiple vulnerabilities in Red Hat Ceph Storage 5.3
• openEuler 22.03 LTS SP1 update for ceph
• openEuler 20.03 LTS SP4 update for ceph
• openEuler 22.03 LTS SP3 update for ceph
• IBM Storage Fusion Data Foundation update for IBM Storage Ceph
• Multiple vulnerabilities in Red Hat Ceph Storage 8