Description
It was found that cephx authentication protocol did not verify ceph clients correctly and was vulnerable to replay attack. Any attacker having access to ceph cluster network who is able to sniff packets on network can use this vulnerability to authenticate with ceph service and perform actions allowed by ceph service. Ceph branches master, mimic, luminous and jewel are believed to be vulnerable.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | ceph | All versions in branches master, mimic, luminous and jewel | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ceph | 12.2.8+dfsg1-1 | — |
| Debian 14 | linux | 4.19.9-1 | — |
| Debian 13 | ceph | 12.2.8+dfsg1-1 | — |
| Debian 13 | linux | 4.19.9-1 | — |
| Debian 12 | ceph | 12.2.8+dfsg1-1 | — |
| Debian 12 | linux | 4.19.9-1 | — |
| Debian 9 | ceph | 10.2.11-1 | DSA-4339-1 |
| Debian 8 | linux-4.9 | 4.9.144-3.1~deb8u1 | DLA-1715-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 14.04 LTS | ceph | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Ceph Storage 3 | ceph +24 | 2:12.2.4-30.el7cp | RHSA-2018:2177 |
| Red Hat Ceph Storage 3 | ceph-ansible | 3.0.39-1.el7cp | RHSA-2018:2177 |
| Red Hat Ceph Storage 3 | cephmetrics +3 | 1.0.1-1.el7cp | RHSA-2018:2177 |
| Red Hat Ceph Storage 3 | nfs-ganesha +2 | 2.5.5-6.el7cp | RHSA-2018:2177 |
| Red Hat Ceph Storage 2 | ceph +21 | 2:10.2.10-28.el7cp | RHSA-2018:2261 |
| Red Hat Ceph Storage 2 | ceph-ansible | 3.0.39-1.el7cp | RHSA-2018:2261 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 | ceph | 13.2.4.125+gad802694f5-3.7.2 | SUSE-SU-2019:0586-1 |
| SLES 15 | kernel-azure +2 | 4.12.14-5.16.1 | SUSE-SU-2018:3961-1 |
| SLES 15 | kernel-docs +6 | 4.12.14-25.19.1 | SUSE-SU-2018:2980-1 |
| SLES 12 SP3 | ceph | 12.2.7+git.1531910353.c0ef85b854-2.12.1 | SUSE-SU-2018:2478-1, SUSE-SU-2018:2193-1 |
| SLES 12 SP3 | kernel-azure +3 | 4.4.155-4.16.1 | SUSE-SU-2018:2858-1 |
| SLES 12 SP3 | kernel-docs +4 | 4.4.155-94.50.1 | SUSE-SU-2018:2776-1 |
| SLES 12 SP2 | kernel-syms +2 | 4.4.121-92.109.2 | SUSE-SU-2019:1287-1 |
| SLES 12 SP2 | kgraft-patch-SLE12-SP2_Update_29 | 1-3.5.2 | SUSE-SU-2019:1287-1 |
Show 8 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP3 | ceph | 12.2.7+git.1531910353.c0ef85b854-2.12.1 | SUSE-SU-2018:2478-1, SUSE-SU-2018:2193-1 |
| SLES for SAP 12 SP3 | kernel-azure +2 | 4.4.155-4.16.1 | SUSE-SU-2018:2858-1 |
| SLES for SAP 12 SP3 | kernel-syms +2 | 4.4.155-94.50.1 | SUSE-SU-2018:2776-1 |
| SLES for SAP 12 SP2 | kernel-syms +2 | 4.4.121-92.109.2 | SUSE-SU-2019:1287-1 |
| SLES for SAP 12 SP2 | kgraft-patch-SLE12-SP2_Update_29 | 1-3.5.2 | SUSE-SU-2019:1287-1 |
| SLE Real Time 12 SP3 | kernel-rt +3 | 4.4.155-3.23.1 | SUSE-SU-2018:2862-1 |
| SLE Live Patching 15 | kernel-default | 4.12.14-25.19.1 | SUSE-SU-2018:2981-1 |
| SLE Live Patching 15 | kernel-livepatch-SLE15_Update_5 | 1-1.3.1 | SUSE-SU-2018:2981-1 |
| SLE Live Patching 12 SP3 | kgraft-patch-SLE12-SP3_Update_17 | 1-4.3.1 | SUSE-SU-2018:2775-1 |
| SUSE OpenStack Cloud 7 | kernel-syms +2 | 4.4.121-92.109.2 | SUSE-SU-2019:1287-1 |
| SUSE OpenStack Cloud 7 | kgraft-patch-SLE12-SP2_Update_29 | 1-3.5.2 | SUSE-SU-2019:1287-1 |
| SUSE Enterprise Storage 5 | ceph | 12.2.5+git.1530082629.8cbf63d997-2.16.1 | SUSE-SU-2018:1920-1 |
| SUSE Enterprise Storage 4 | ceph +1 | 10.2.11+git.1531487710.3a12911a2e-12.14.2 | SUSE-SU-2018:2299-1 |
| SUSE Enterprise Storage 4 | kernel-syms +2 | 4.4.121-92.109.2 | SUSE-SU-2019:1287-1 |
| SUSE Enterprise Storage 4 | kgraft-patch-SLE12-SP2_Update_29 | 1-3.5.2 | SUSE-SU-2019:1287-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.0 | ceph +1 | 13.2.4.125+gad802694f5-lp150.2.3.1 | openSUSE-SU-2019:1284-1 |
Advisories 19
- WID-SEC-2026-3896 Linux Kernel: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 13, 2026
- RHSA-2018:2261 Red Hat Security Advisory: Red Hat Ceph Storage 2.5 security, enhancement, and bug fix update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2018:2177 Red Hat Security Advisory: Red Hat Ceph Storage 3.0 security and bug fix update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- DSA-4339-1 ceph - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-1715-1 linux-4.9 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2018:2981-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:2775-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:1287-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:2193-1 Security update for ceph SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:2980-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:2478-1 Security update for ceph SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:3961-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:0586-1 Security update for ceph SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:2858-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:2776-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2019:1284-1 Security update for ceph SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:2862-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · May 2, 2025
- SUSE-SU-2018:2299-1 Security update for ceph SUSE / openSUSE Security Updates · May 2, 2025
- SUSE-SU-2018:1920-1 Security update for ceph SUSE / openSUSE Security Updates · May 2, 2025
References
- RHSA-2018:2261 vendor-advisory
- RHSA-2018:2177 vendor-advisory
- https://github.com/ceph/ceph/commit/5ead97120e07054d80623dada90a5cc764c28468
- RHSA-2018:2179 vendor-advisory
- RHSA-2018:2274 vendor-advisory
- DSA-4339 vendor-advisory
- [debian-lts-announce] 20190315 [SECURITY] [DLA 1715-1] linux-4.9 security update mailing-list
- http://tracker.ceph.com/issues/24836
- https://bugzilla.redhat.com/show_bug.cgi?id=1575866
- openSUSE-SU-2019:1284 vendor-advisory
- [oss-security] 20201117 CVE-2020-25677 ceph: CEPHX_V2 replay attack protection lost mailing-list
- [oss-security] 20201117 Re: CVE-2020-25677 ceph: CEPHX_V2 replay attack protection lost mailing-list