CVE-2018-14662: Medium severity redhat Ceph vulnerability
It was found Ceph versions before 13.2.4 that authenticated ceph users with read only permissions could steal dm-crypt encryption keys used in ceph disk encryption.
Other sources
The Ceph documentation states that clients should use "allow r" mon caps[1][2][3], which will grant full read access to all config-keys stored in the monitor -- including the LUKS encryption keys for OSD.
This is in contrast to the original dm-crypt key management feature[4], which indicates that these keys should be restricted to only the lockbox user.
Upstream Documentation:
[1] http://docs.ceph.com/docs/master/cephfs/client-auth/ [2] http://docs.ceph.com/docs/emperor/rados/operations/authentication/#add-a-key [3] http://docs.ceph.com/docs/master/rados/operations/user-management/#add-a-user [4] https://tracker.ceph.com/projects/ceph/wiki/Osd-simpleceph-mondm-cryptkeymanagement
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2018-14662?
CVE-2018-14662 is a vulnerability found in Ceph versions before 13.2.4 that allows authenticated ceph users with read only permissions to steal dm-crypt encryption keys used in ceph disk encryption.
What is the severity of CVE-2018-14662?
The severity of CVE-2018-14662 is medium with a severity value of 5.7.
Which software versions are affected by CVE-2018-14662?
Ceph versions before 13.2.4 are affected by CVE-2018-14662.
How do I fix CVE-2018-14662?
To fix CVE-2018-14662, it is recommended to update to Ceph version 13.2.4 or later.
Where can I find more information about CVE-2018-14662?
You can find more information about CVE-2018-14662 at the following references: [1](http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00100.html), [2](https://access.redhat.com/errata/RHSA-2019:2538), [3](https://access.redhat.com/errata/RHSA-2019:2541).