Alexander Patrakov wrote: [...] What would be a good solution (as in: something that does not convert crashes into deadlocks) here? I understand that, after memory corruption, we are already in the UB territory, but is there anything better possible than what is implemented?
-- Jacob
Red Hat Ceph Storage is a scalable, open, software-defined storage platform that combines the most stable version of the Ceph storage system with a Ceph management platform, deployment utilities, and support services.<br>This new container image is based on Red Hat Ceph Storage 6.1 and Red Hat Enterprise Linux 9.<br>Security Fix(es):<br><li> crewjam/saml: Authentication bypass when processing SAML responses containing multiple Assertion elements (CVE-2022-41912)</li> <li> eventsource: Exposure of Sensitive Information (CVE-2022-1650)</li> <li> grafana: stored XSS vulnerability (CVE-2022-31097)</li> <li> grafana: OAuth account takeover (CVE-2022-31107)</li> <li> ramda: prototype poisoning (CVE-2021-42581)</li> <li> golang: net/<a href="http:" target="blank">http:</a> improper sanitization of Transfer-Encoding header (CVE-2022-1705)</li> <li> golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters (CVE-2022-2880)</li> <li> marked: regular expression block.def may lead Denial of Service (CVE-2022-21680)</li> <li> marked: regular expression inline.reflinkSearch may lead Denial of Service (CVE-2022-21681)</li> <li> golang: encoding/pem: fix stack overflow in Decode (CVE-2022-24675)</li> <li> Moment.js: Path traversal in moment.locale (CVE-2022-24785)</li> <li> grafana: An information leak issue was discovered in Grafana through 7.3.4, when integrated with Zabbix (CVE-2022-26148)</li> <li> golang: net/<a href="http:" target="blank">http:</a> handle server errors after sending GOAWAY (CVE-2022-27664)</li> <li> golang: encoding/xml: stack exhaustion in Decoder.Skip (CVE-2022-28131)</li> <li> golang: crypto/elliptic: panic caused by oversized scalar (CVE-2022-28327)</li> <li> golang: syscall: faccessat checks wrong group (CVE-2022-29526)</li> <li> golang: io/fs: stack exhaustion in Glob (CVE-2022-30630)</li> <li> golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631)</li> <li> golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632)</li> <li> golang: encoding/xml: stack exhaustion in Unmarshal (CVE-2022-30633)</li> <li> golang: encoding/gob: stack exhaustion in Decoder.Decode (CVE-2022-30635)</li> <li> grafana: plugin signature bypass (CVE-2022-31123)</li> <li> grafana: data source and plugin proxy endpoints leaking authentication tokens to some destination plugins (CVE-2022-31130)</li> <li> golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working (CVE-2022-32148)</li> <li> golang: net/url: JoinPath does not strip relative path components in all circumstances (CVE-2022-32190)</li> <li> grafana: Escalation from admin to server admin when auth proxy is used (CVE-2022-35957)</li> <li> grafana: Data source and plugin proxy endpoints could leak the authentication cookie to some destination plugins (CVE-2022-39201)</li> <li> grafana: using email as a username can block other users from signing in (CVE-2022-39229)</li> <li> grafana: email addresses and usernames cannot be trusted (CVE-2022-39306)</li> <li> grafana: User enumeration via forget password (CVE-2022-39307)</li> <li> grafana: Spoofing of the originalUrl parameter of snapshots (CVE-2022-39324)</li> <li> golang: regexp/syntax: limit memory used by parsing regexps (CVE-2022-41715)</li> <li> golang: crypto/tls: session tickets lack random ticketageadd (CVE-2022-30629)</li> <li> golang: math/big: decoding big.Float and big.Rat types can panic if the encoded message is too short, potentially allowing a denial of service (CVE-2022-32189)</li> For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.<br>Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat Ceph Storage Release Notes for information on the most significant of these changes:<br><a href="https://access.redhat.com/documentation/en-us/redhatcephstorage/6.1/html/releasenotes/index" target="blank">https://access.redhat.com/documentation/en-us/redhatcephstorage/6.1/html/releasenotes/index</a> All users of Red Hat Ceph Storage are advised to pull these new images from the Red Hat Ecosystem catalog, which provides numerous enhancements and bug fixes.
Red Hat Ceph Storage is a scalable, open, software-defined storage platform<br>that combines the most stable version of the Ceph storage system with a<br>Ceph management platform, deployment utilities, and support services.<br>This new container image is based on Red Hat Ceph Storage 5.2 and Red Hat<br>Enterprise Linux 8.6 and Red Hat Enterprise Linux 9.<br>Space precludes documenting all of these changes in this advisory. Users<br>are directed to the Red Hat Ceph Storage Release Notes for information on<br>the most significant of these changes:<br><a href="https://access.redhat.com/documentation/en-us/redhatcephstorage/5.2/html-single/releasenotes/index" target="blank">https://access.redhat.com/documentation/en-us/redhatcephstorage/5.2/html-single/releasenotes/index</a> All users of Red Hat Ceph Storage are advised to pull these new images from<br>the Red Hat Ecosystem catalog, which provides numerous enhancements and bug<br>fixes.<br>Security Fix(es):<br><li> grafana: Forward OAuth Identity Token can allow users to access some data sources (CVE-2022-21673)</li> <li> grafana: directory traversal vulnerability (CVE-2021-43813)</li> For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
A flaw was found in Openstack manilla owning a Ceph File system "share", which enables the owner to read/write any manilla share or entire file system. The vulnerability is due to a bug in the "volumes" plugin in Ceph Manager. This allows an attacker to compromise Confidentiality and Integrity of a file system. Fixed in RHCS 5.2 and Ceph 17.2.2.
An authentication flaw was found in ceph in versions before 14.2.20. When the monitor handles CEPHXGETAUTHSESSIONKEY requests, it doesn't sanitize otherkeys, allowing key reuse. An attacker who can request a globalid can exploit the ability of any user to request a globalid previously associated with another user, as ceph does not force the reuse of old keys to generate new ones. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
The rhceph-4.2 image is based on Red Hat Ceph Storage 4.2 and Red Hat Enterprise Linux.Security Fix(es): grafana: SSRF incorrect access control vulnerability allows unauthenticated users to make grafana send HTTP requests to any URL (CVE-2020-13379) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Bug Fix(es):Users are directed to the Red Hat Ceph Storage 4.2 Release Notes for information on the most significant of these changes:https://access.redhat.com/documentation/en-us/redhatcephstorage/4.2/html /releasenotes/All users of the rhceph-4.2 image are advised to pull this updated image from the Red Hat Ecosystem Catalog.
A flaw was found in ceph-dashboard. The JSON Web Token (JWT) used for user authentication is stored by the frontend application in the browser’s localStorage which is potentially vulnerable to attackers via XSS attacks. The highest threat from this vulnerability is to data confidentiality and integrity.
A flaw was found in ceph in versions prior to 16.y.z where ceph stores mgr module passwords in clear text. This can be found by searching the mgr logs for grafana and dashboard, with passwords visible.
A flaw was found in Ceph-ansible v4.0.41 where it creates an /etc/ceph/iscsi-gateway.conf with insecure default permissions. This flaw allows any user on the system to read sensitive information within this file. The highest threat from this vulnerability is to confidentiality.
A flaw was found in the Cephx authentication protocol in versions before 15.2.6 and before 14.2.14, where it does not verify Ceph clients correctly and is then vulnerable to replay attacks in Nautilus. This flaw allows an attacker with access to the Ceph cluster network to authenticate with the Ceph service via a packet sniffer and perform actions allowed by the Ceph service. This issue is a reintroduction of CVE-2018-1128, affecting the msgr2 protocol. The msgr 2 protocol is used for all communication except older clients that do not support the msgr2 protocol. The msgr1 protocol is not affected. The highest threat from this vulnerability is to confidentiality, integrity, and system availability.
A flaw was found in the Ceph Object Gateway, where it supports request sent by an anonymous user in Amazon S3. This flaw could lead to potential XSS attacks due to the lack of proper neutralization of untrusted input.
A path traversal flaw was found in the Ceph dashboard implemented in upstream versions v14.2.5, v14.2.6, v15.0.0 of Ceph storage and has been fixed in versions 14.2.7 and 15.1.0. An unauthenticated attacker could use this flaw to cause information disclosure on the host machine running the Ceph dashboard.
A flaw was found in the Ceph Object Gateway S3 API, where it did not properly validate the POST requests. This flaw allows an attacker to perform a denial of service attack using a malicious POST request with specially crafted XML payload, leading to a crash of the RGW process.
A flaw was found in the ceph-ansible playbook where it contained hardcoded passwords that were being used as default passwords while deploying Ceph services. Any authenticated attacker can abuse this flaw to brute-force Ceph deployments, and gain administrator access to Ceph clusters via the Ceph dashboard to initiate read, write, and delete Ceph clusters and also modify Ceph cluster configurations. Versions before ceph-ansible 6.0.0alpha1 are affected.
A flaw was found in the Ceph RGW configuration with Beast as the front end handling client requests. An unauthenticated attacker could crash the Ceph RGW server by sending valid HTTP headers and terminating the connection, resulting in a remote denial of service for Ceph RGW clients.
Ceph does not properly sanitize encryption keys in debug logging for v4 auth. This results in the leaking of encryption key information in log files via plaintext.
Upstream Patch:
https://github.com/ceph/ceph/pull/25881/commits
Upstream Bug:
http://tracker.ceph.com/issues/37847
A flaw was found in Red Hat Ceph before 0.94.9-8. The way Ceph Object Gateway handles POST object requests permits an authenticated attacker to launch a denial of service attack by sending null or specially crafted POST object requests.
Red Hat Ceph Storage is a scalable, open, software-defined storage platform that combines the most stable version of the Ceph storage system with a Ceph management platform, deployment utilities, and support services.<br>Security Fix(es):<br><li> ceph: cephx protocol is vulnerable to replay attack (CVE-2018-1128)</li> <li> ceph: cephx uses weak signatures (CVE-2018-1129)</li> <li> ceph: ceph-mon does not perform authorization on OSD pool ops (CVE-2018-10861)</li> For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.<br>Bug Fix(es):<br><li> Previously, Ceph RADOS Gateway (RGW) instances in zones configured for multi-site replication would crash if configured to disable sync ("rgwrunsyncthread = false"). Therefor, multi-site replication environments could not start dedicated non-replication RGW instances. With this update, the "rgwrunsyncthread" option can be used to configure RGW instances that will not participate in replication even if their zone is replicated. (BZ#1552202)</li> <li> Previously, when increasing "maxmds" from "1" to "2", if the Metadata Server (MDS) daemon was in the starting/resolve state for a long period of time, then restarting the MDS daemon lead to assert. This caused the Ceph File System (CephFS) to be in degraded state. With this update, increasing "maxmds" no longer causes CephFS to be in degraded state. (BZ#1566016)</li> <li> Previously, the transition to containerized Ceph left some "ceph-disk" unit files. The files were harmless, but appeared as failing. With this update, executing the "switch-from-non-containerized-to-containerized-ceph-daemons.yml" playbook disables the "ceph-disk" unit files too. (BZ#1577846)</li> <li> Previously, the "entriesbehindmaster" metric output from the "rbd mirror image status" CLI tool did not always reduce to zero under synthetic workloads. This could cause a false alarm that there is an issue with RBD mirroring replications. With this update, the metric is now updated periodically without the need for an explicit I/O flush in the workload. (BZ#1578509)</li> <li> Previously, when using the "pool create" command with "expectednumobjects", placement group (PG) directories were not pre-created at pool creation time as expected, resulting in performance drops when filestore splitting occurred. With this update, the "expectednumobjects" parameter is now passed through to filestore correctly, and PG directories for the expected number of objects are pre-created at pool creation time. (BZ#1579039)</li> <li> Previously, internal RADOS Gateway (RGW) multi-site sync logic behaved incorrectly when attempting to sync containers with S3 object versioning enabled. Objects in versioning-enabled containers would fail to sync in some scenarios—for example, when using "s3cmd sync" to mirror a filesystem directory. With this update, RGW multi-site replication logic has been corrected for the known failure cases. (BZ#1580497)</li> <li> When restarting OSD daemons, the "ceph-ansible" restart script goes through all the daemons by listing the units with systemctl list-units. Under certain circumstances, the output of the command contains extra spaces, which caused parsing and restart to fail. With this update, the underlying code has been changed to handle the extra space.</li> <li> Previously, the Ceph RADOS Gateway (RGW) server treated negative byte-range object requests ("bytes=0--1") as invalid. Applications that expect the AWS behavior for negative or other invalid range requests saw unexpected errors and could fail. With this update, a new option "rgwignoregetinvalidrange" has been added to RGW. When "rgwignoregetinvalidrange" is set to "true", the RGW behavior for invalid range requests is backwards compatible with AWS.</li>
A flaw was found in the way ceph mon handles user requests. Any authenticated ceph user having read access to ceph can delete, and corrupt snapshot images.
This would require user to have read access and for that user must have key for authentication. It would only affect snapshots and images. So attacker with read access will only be able to corrupt data of snapshot images and rest of the ceph cluster should work as it is. Affect on integrity would be low and availability part can be controlled by mitigation using 'monallowpooldelete = false' in ceph.conf to disable deletion of pools
In ceph, HTTP request headers without a ":" character that are handled in rgwcivetweb.cc:RGW::initenv() can cause variables to be set to NULL, leading to a crash or other potentially unspecified behaviour.
Upstream Pull Request:
https://github.com/ceph/ceph/pull/20403
The RGW code in Ceph before 10.0.1, when authenticated-read ACL is applied to a bucket, allows remote attackers to list the bucket contents via a URL.
Ceph monitors crash when an empty or malformed prefix is sent to moncommand by rados.py. Authenticated attacker can crash ceph monitors by sending specially crafted input to moncommand via rados.py.
CRLF injection vulnerability in the Ceph Object Gateway (aka radosgw or RGW) in Ceph before 0.94.4 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted bucket name.
ceph-deploy before 1.5.23 uses weak permissions (644) for ceph/ceph.client.admin.keyring, which allows local users to obtain sensitive information by reading the file.
The admin command in ceph-deploy before 1.5.25 uses world-readable permissions for /etc/ceph/ceph.client.admin.keyring, which allows local users to obtain sensitive information by reading the file.