Ceph Monitor: any read-only CephX user can dump the config-key store, including cephadm's cluster-wide SSH key

Impact

A CephX identity holding nothing more than mon allow r can send one crafted MMonSubscribe message and read the entire monitor config-key store. That store holds OSD LUKS disk-encryption passphrases and, on cephadm-managed clusters, the SSH private key cephadm uses to log into every host in the cluster - which is root by default. On a GPU fleet where Ceph backs the shared dataset and checkpoint tier, this turns any low-privileged read-only key handed to a tenant job, a monitoring agent, or a CSI provisioner into root on every storage host, and hands over the keys needed to decrypt OSD media offline. Credentials distributed to many clients are hard to recall, so rotation after exposure is a fleet-wide job, not a single change.

Who can reach it

Any authenticated CephX client that can reach the monitors and holds at least mon allow r. No elevated capability and no local access required.

What to do

Upgrade to Ceph 20.2.4 or 19.2.6 and restart the monitor daemons; this is a rolling restart of the mon quorum and does not require draining GPU nodes. Because the SSH key and LUKS passphrases may already have been read by anyone who held a read-only key, treat them as exposed: rotate the cephadm SSH key and review which clients hold mon allow r after upgrading. Until you can upgrade, audit and trim read-only CephX capabilities handed to tenants and side-car services.

References

Related entries

• AMD EPYC / Ryzen - Hardware Validated Boot enforcement: Hardware Validated Boot is not properly enforced, so anCVE-2018-8930 · AMD EPYC / Ryzen - Hardware Validated Boot enforcementCritical
• AMD EPYC Server - protected memory region access control: Insufficient access control over protected memory regions onCVE-2018-8933 · AMD EPYC Server - protected memory region access controlCritical
• PC-DDR4 / LPDDR4X DRAM - Target Row Refresh mitigation: Non-uniform Rowhammer patterns triggered bit flips on every oneCVE-2021-42114 · PC-DDR4 / LPDDR4X DRAM - Target Row Refresh mitigationCritical
• Digi RealPort protocol (Digi console/terminal servers): RealPort is the protocol Digi console servers use to exposeCVE-2023-4299 · Digi RealPort protocol (Digi console/terminal servers)Critical
• Ivanti Connect Secure: Stack-based buffer overflowCVE-2025-0282 · Ivanti Connect SecureCritical
• Ivanti Connect Secure/ZTA: Stack-based buffer overflowCVE-2025-22457 · Ivanti Connect Secure/ZTACritical