CVE-2021-3979: Medium severity red hat ceph storage vulnerability
A key length flaw was found in Red Hat Ceph Storage. An attacker can exploit the fact that the key length is incorrectly passed in an encryption algorithm to create a non random key, which is weaker and can be exploited for loss of confidentiality and integrity on encrypted disks.
Other sources
The key length for encrypted devices created using ceph-volume is incorrect. This is due to a bug in cephvolume/util/encryption.py, where upon writing a key using osddmcryptkeysize it does not pass the key size to the format and open operations following. The default key is them applied in cryptsetup. All versions since Luminous are assumed affected.
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2021-3979?
CVE-2021-3979 is a key length flaw found in Red Hat Ceph Storage that can be exploited to create a non-random key, resulting in loss of confidentiality and integrity on encrypted disks.
How severe is CVE-2021-3979?
CVE-2021-3979 has a severity score of 6.5, which is considered medium.
Which software versions are affected by CVE-2021-3979?
The affected software versions include Red Hat Ceph Storage 12.2.13-0ubuntu0.18.04.11, 15.2.17-0ubuntu0.20.04.3, 16.2.9+, and 2:14.2.22-110.el7c and 2:16.2.7-98.el8c.
How can I fix CVE-2021-3979?
To fix CVE-2021-3979, update Red Hat Ceph Storage to version 16.2.11+ds-2 or higher.
Where can I find more information about CVE-2021-3979?
You can find more information about CVE-2021-3979 on the Red Hat Bugzilla website: https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2018529