Ceph CephX authentication protocol: CephX does not correctly bind client identity, so an attacker who can capture

Impact

CephX does not correctly bind client identity, so an attacker who can capture cluster traffic can replay an authentication exchange and act as that client. On a flat storage fabric this lets one tenant impersonate another tenant's OSD/MDS session and reach their data.

Who can reach it

An attacker on the Ceph public or cluster network able to observe and re-send traffic - an adjacent compute node on the same storage VLAN is sufficient.

What to do

Upgrade to Ceph 14.2.14 / 15.2.6 or later and restart mons, OSDs and MDSes. Enable msgr2 secure mode (ms_cluster_mode=secure, ms_service_mode=secure) so cluster traffic is encrypted and authenticated end to end, and put tenant traffic on a separate L2 domain from the storage fabric.

References