Ceph MON (ceph-mon): The monitor accepts pool create/delete and snapshot operations from any authenticated user that

Impact

The monitor accepts pool create/delete and snapshot operations from any authenticated user that only has read access. A read-only tenant key becomes a cluster-wide destructive capability - it can delete the pool holding another tenant's dataset or corrupt their RBD snapshots.

Who can reach it

Any authenticated Ceph user with read access that can reach the monitors, so any tenant node holding a client keyring.

What to do

Upgrade ceph-mon to the fixed release and restart it. Then review pool-level and mon caps for every client key, and separate tenants into distinct pools with explicit per-pool caps rather than a broad read cap.

References

Related entries

• GlusterFS (brick, gfs3_mknod_req): A crafted mknod RPC traverses out of the volume and writes a file anywhere the brickCVE-2018-10926 · GlusterFS (brick, gfs3_mknod_req)High
• Cisco IOS XE MACsec Key Agreement (MKA over EAP-TLS): A logic error in MKA over EAP-TLS lets an unauthenticatedCVE-2018-15372 · Cisco IOS XE MACsec Key Agreement (MKA over EAP-TLS)High
• PostgreSQL: With cert/trust+clientcert auth, a MITM can inject arbitrary SQL at connection setupCVE-2021-23214 · PostgreSQLHigh
• tcmu-runner 1.3.x - 1.5.2 (userspace backstore handler for the Linux LIO target, used by Ceph iSCSI gateways and otherCVE-2021-3139 · tcmu-runner 1.3.x - 1.5.2High
• ClickHouse: Attacker-controlled offset in the LZ4 codecCVE-2021-42387 · ClickHouseHigh
• ClickHouse: Second heap out-of-bounds read in LZ4::decompressImpl reachable from a client queryCVE-2021-42388 · ClickHouseHigh