Description
User credentials can be manipulated and stolen by Native CephFS consumers of OpenStack Manila, resulting in potential privilege escalation. An Open Stack Manila user can request access to a share to an arbitrary cephx user, including existing users. The access key is retrieved via the interface drivers. Then, all users of the requesting OpenStack project can view the access key. This enables the attacker to target any resource that the user has access to. This can be done to even "admin" users, compromising the ceph administrator. This flaw affects Ceph versions prior to 14.2.16, 15.x prior to 15.2.8, and 16.x prior to 16.2.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Ceph | Ceph 16.2.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ceph | 14.2.16-1 | — |
| Debian 13 | ceph | 14.2.16-1 | — |
| Debian 12 | ceph | 14.2.16-1 | — |
| Debian 10 | ceph | 12.2.11+dfsg1-2.1+deb10u1 | DLA-3629-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | ceph | 15.2.12-0ubuntu0.20.04.1 | USN-4998-1 |
| Ubuntu 18.04 LTS | ceph | 12.2.13-0ubuntu0.18.04.10 | USN-5128-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | ceph | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Ceph Storage 4 | ceph +32 | 2:14.2.11-95.el7cp | RHSA-2021:0081 |
| Red Hat Ceph Storage 4 | ceph-ansible | 4.0.41-1.el7cp | RHSA-2021:0081 |
| Red Hat Ceph Storage 4 | python3-rbd +4 | 2:14.2.11-95.el8cp | RHSA-2021:0081 |
| Red Hat Ceph Storage 3 | ceph +24 | 2:12.2.12-139.el7cp | RHSA-2021:1518 |
| Red Hat Ceph Storage 3 | ceph-ansible | 3.2.56-1.el7cp | RHSA-2021:1518 |
| Red Hat Ceph Storage 3 | cephmetrics +1 | 2.0.10-1.el7cp | RHSA-2021:1518 |
| Red Hat Ceph Storage 3 | grafana | 5.2.4-3.el7cp | RHSA-2021:1518 |
| Red Hat Ceph Storage 3 | tcmu-runner | 1.4.0-3.el7cp | RHSA-2021:1518 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP2 | ceph | 15.2.8.80+g1f4b6229ca-3.13.1 | SUSE-SU-2020:3895-1 |
| SLES 15 SP1 | ceph | 14.2.16.402+g7d47dbaf4d-3.57.1 | SUSE-SU-2021:0023-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Enterprise Storage 7 | ceph | 15.2.8.80+g1f4b6229ca-3.13.1 | SUSE-SU-2020:3895-1 |
| SUSE Enterprise Storage 6 | ceph | 14.2.16.402+g7d47dbaf4d-3.57.1 | SUSE-SU-2021:0023-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | ceph | 16.2.6.463+g22e7612f9ad-1.1 | openSUSE-SU-2024:11652-1 |
| openSUSE Leap 15.2 | ceph +1 | 15.2.8.80+g1f4b6229ca-lp152.2.9.1 | openSUSE-SU-2020:2327-1 |
| openSUSE Leap 15.1 | ceph +1 | 14.2.16.402+g7d47dbaf4d-lp151.2.31.1 | openSUSE-SU-2021:0079-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.18 | ceph16 | 15.2.8-r0 | — |
| Alpine v3.17 | ceph16 | 15.2.8-r0 | — |
| Alpine v3.16 | ceph | 15.2.8-r0 | — |
| Alpine v3.15 | ceph | 15.2.8-r0 | — |
| Alpine v3.14 | ceph | 15.2.8-r0 | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.13 | ceph | 15.2.8-r0 | — |
| Alpine v3.12 | ceph | 14.2.19-r0 | — |
| Alpine v3.11 | ceph | 14.2.19-r0 | — |
Advisories 11
- RHSA-2021:0081 Red Hat Security Advisory: Red Hat Ceph Storage 4.2 Security and Bug Fix update Red Hat Security Advisories (RHSA) · Aug 19, 2026
- RHSA-2021:1518 Red Hat Security Advisory: Red Hat Ceph Storage 3.3 Security and Bug Fix Update Red Hat Security Advisories (RHSA) · Aug 8, 2026
- USN-5128-1 ceph vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- USN-4998-1 ceph vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- DLA-3629-1 ceph - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:11652-1 ceph-16.2.6.463+g22e7612f9ad-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2020:3895-1 Security update for ceph SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2020:2327-1 Security update for ceph SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2021:0079-1 Security update for ceph SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:0023-1 Security update for ceph SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2023-2730 Red Hat Ceph Storage: Mehrere Schwachstellen ermöglichen Offenlegung von Informationen BSI CERT-Bund (WID) · Oct 23, 2023
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1900109
- FEDORA-2020-fcafbe7225 vendor-advisory
- GLSA-202105-39 vendor-advisory
- [debian-lts-announce] 20231023 [SECURITY] [DLA 3629-1] ceph security update mailing-list