Ceph MON (CephX authentication): The monitor does not sanitize other_keys when handling CEPHX_GET_AUTH_SESSION_KEY, so

Impact

The monitor does not sanitize other_keys when handling CEPHX_GET_AUTH_SESSION_KEY, so an attacker who has any CephX credential (or who can force one to be reissued) can reuse a key and authenticate as a different, higher-privileged Ceph entity. That is escalation from one tenant's cephx identity to another's, including admin-level access to pools they do not own.

Who can reach it

Anyone holding a valid CephX credential for the cluster and able to reach the monitors on the cluster/public network - which includes any tenant compute node that mounts RBD or CephFS natively.

What to do

Upgrade the monitors to Ceph 14.2.20 or later (and matching Octopus/Pacific builds), then restart ceph-mon. Rotate CephX keys afterwards, since anything issued before the fix could already have been reused. Keep the Ceph public network off tenant-routable paths.

References