Ceph MON / MGR (ceph-mon, ceph-mgr): Ceph-mon and ceph-mgr fail to enforce the caps on an authenticated principal, so a

Impact

Ceph-mon and ceph-mgr fail to enforce the caps on an authenticated principal, so a low-privileged CephX user reaches admin-only commands. From there the attacker can read and change cluster configuration, create or delete pools and effectively take ownership of storage belonging to other tenants.

Who can reach it

Any authenticated CephX principal that can reach the mon or mgr on the Ceph public network, including tenant nodes that hold only a restricted client key.

What to do

Upgrade to Ceph 15.2.2 or later and restart ceph-mon and ceph-mgr. Audit the caps on every CephX principal afterwards and revoke any that were widened. Never expose mon/mgr ports to tenant-routable networks.

References