Ceph CephX authentication protocol: The CephX signature calculation can be bypassed, so an on-path attacker can alter

Impact

The CephX signature calculation can be bypassed, so an on-path attacker can alter the payload of an authenticated Ceph message without the signature failing. In practice that means tampering with another tenant's in-flight RADOS operations - silent data corruption on a shared pool with no authentication failure logged.

Who can reach it

An on-path attacker on the Ceph public or cluster network who can modify frames in transit.

What to do

Upgrade to a fixed Ceph release and restart all daemons. Turn on msgr2 secure mode so integrity is protected by real AEAD rather than the legacy signature, and keep the cluster network physically or logically separate from tenant traffic.

References