Description
The handle_command function in mon/Monitor.cc in Ceph allows remote authenticated users to cause a denial of service (segmentation fault and ceph monitor crash) via an (1) empty or (2) crafted prefix.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ceph | 10.2.5-1 | — |
| Debian 13 | ceph | 10.2.5-1 | — |
| Debian 12 | ceph | 10.2.5-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | ceph | 0.80.11-0ubuntu1.14.04.3 | USN-3452-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Ceph Storage 1 | ceph +12 | 1:0.94.5-14.el7cp | RHSA-2016:1384 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP2 | ceph | 10.2.4+git.1481215985.12b091b-16.2 | SUSE-SU-2017:0367-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP2 | ceph | 10.2.4+git.1481215985.12b091b-16.2 | SUSE-SU-2017:0367-1 |
| SUSE Enterprise Storage 3 | ceph | 10.2.3+git.1475228057.755cf99-7.3 | SUSE-SU-2016:2809-1 |
Advisories 4
- RHSA-2016:1384 Red Hat Security Advisory: ceph security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- USN-3452-1 ceph vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- SUSE-SU-2016:2809-1 Recommended update for ceph SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2017:0367-1 Security update for ceph SUSE / openSUSE Security Updates · Feb 4, 2026
References
- http://tracker.ceph.com/issues/16297
- RHSA-2016:1384 vendor-advisory
- https://github.com/ceph/ceph/commit/957ece7e95d8f8746191fd9629622d4457d690d6
- RHSA-2016:1385 vendor-advisory
- https://github.com/ceph/ceph/pull/9700
- openSUSE-SU-2016:3201 vendor-advisory