Red Hat Ceph Storage 2 update for ceph

1) Security restrictions bypass

EUVDB-ID: #VU14329

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-10861

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows an adjacent authenticated attacker to bypass security restrictions on the target system.

The vulnerability exists in ceph branches master, mimic, luminous and jewel due to improper handling of user-supplied requests by ceph mon. An adjacent attacker with read access to ceph can delete, create ceph storage pools and corrupt snapshot images.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux for Scientific Computing: 7

Red Hat Enterprise Linux Desktop: 7

Red Hat Enterprise Linux Workstation: 7

Red Hat Enterprise Linux Server: 7

Ceph: before 10.2.10-28.el7cp

ceph-ansible (Red Hat package): before 3.0.39-1.el7cp

CPE2.3

• cpe:2.3:o:red_hat:red_hat_enterprise_linux_for_scientific_computing:7:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:o:red_hat:red_hat_enterprise_linux_desktop:7:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:o:red_hat:red_hat_enterprise_linux_workstation:7:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:o:red_hat:red_hat_enterprise_linux_server:7:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:ceph:*:*:*:*:*:*:*:*
• cpe:2.3:o:red_hat:ceph-ansible_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*

External links

https://access.redhat.com/errata/RHSA-2018:2261

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Security restrictions bypass

EUVDB-ID: #VU14542

Risk: Low

CVSSv4.0: 0.6 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-1128

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows an adjacent attacker to conduct replay attack on the target system.

The vulnerability exists in ceph branches master, mimic, luminous and jewel due to cephx authentication protocol did not verify ceph clients correctly. An adjacent attacker with access to ceph cluster network who is able to sniff packets on network can authenticate with ceph service, perform actions allowed by ceph service, conduct replay attack and bypass security restrictions.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux for Scientific Computing: 7

Red Hat Enterprise Linux Desktop: 7

Red Hat Enterprise Linux Workstation: 7

Red Hat Enterprise Linux Server: 7

Ceph: before 10.2.10-28.el7cp

ceph-ansible (Red Hat package): before 3.0.39-1.el7cp

CPE2.3

• cpe:2.3:o:red_hat:red_hat_enterprise_linux_for_scientific_computing:7:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:o:red_hat:red_hat_enterprise_linux_desktop:7:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:o:red_hat:red_hat_enterprise_linux_workstation:7:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:o:red_hat:red_hat_enterprise_linux_server:7:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:ceph:*:*:*:*:*:*:*:*
• cpe:2.3:o:red_hat:ceph-ansible_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*

External links

https://access.redhat.com/errata/RHSA-2018:2261

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Security restrictions bypass

EUVDB-ID: #VU14543

Risk: Low

CVSSv4.0: 0.6 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-1129

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows an adjacent attacker to bypass security restrictions on the target system.

The vulnerability exists in ceph branches master, mimic, luminous and jewel due to improper handling of signature calculation by cephx authentication protocol. An adjacent attacker with access to ceph cluster network who is able to alter the message payload can bypass signature checks done by cephx protocol to conduct further attacks.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux for Scientific Computing: 7

Red Hat Enterprise Linux Desktop: 7

Red Hat Enterprise Linux Workstation: 7

Red Hat Enterprise Linux Server: 7

Ceph: before 10.2.10-28.el7cp

ceph-ansible (Red Hat package): before 3.0.39-1.el7cp

CPE2.3

• cpe:2.3:o:red_hat:red_hat_enterprise_linux_for_scientific_computing:7:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:o:red_hat:red_hat_enterprise_linux_desktop:7:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:o:red_hat:red_hat_enterprise_linux_workstation:7:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:o:red_hat:red_hat_enterprise_linux_server:7:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:ceph:*:*:*:*:*:*:*:*
• cpe:2.3:o:red_hat:ceph-ansible_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*

External links

https://access.redhat.com/errata/RHSA-2018:2261

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.