is public via oss-sec

From: Ana McTaggart <amctagga@redhat.com>
To: oss-security@lists.openwall.com
Subject: [oss-security] CVE-2020-27781 User credentials can be manipulated and stolen by Native CephFS consumers of OpenStack Manila


Dear all,
We have received a report of the following vulnerability affecting CephFS.
At Red Hat, we have assigned it CVE-2020-27781

We are proposing a public date of 12/16/2020, as suggested by the
reporter, but want to ensure agreement with upstream first.
I have included our original description of the flaw as follows.

Issue: User credentials can be manipulated and stolen by Native CephFS
consumers of OpenStack Manila

Products affected: RHCS 3.x, RHCS 4.x

Who reported this vulnerability:
   - Garbutt, John <john@johngarbutt.com>
   - Babel, Jahson <jahson.babel@cc.in2p3.fr>;
   - Pacha Ravi, Goutham <gouthamr@redhat.com>;

Details:

OpenStack Manila can provide users with Native CephFS shared file
systems [1]. When a user creates a "share" (short for "shared file
system") via Manila, a CephFS "subvolume" is created on the Ceph
cluster and exported to the manila user. After creating their share, a
user can specify who has access to the share with the help of "cephx"
client user names. A cephx client corresponds to Ceph Client Users
[2]. When access is provided, a client user key is returned via
manila. The interaction between manila and CephFS is driven by two
important parts:
 - The CephFS driver in manila [3]
 - The "ceph_volume_client" python interface driver in ceph [4]

The problem here is that OpenStack Manila users can request access to
a share to any arbitrary cephx user, including privileged pre-existing
users and the interface drivers will retrieve the access key of that
user along with providing access to the share. This access key is then
visible to all users of the OpenStack project that owns the share.
With the help of any prior capabilities of the pre-existing cephx
client user, an attacker has unintended access to the access key of
the user and can target any resource that the user has access to. An
attacker can even obtain the default ceph "admin" user's key in this
manner, and execute any commands as the ceph administrator.

Thanks,
Goutham Pacha Ravi
Project Technical Lead, OpenStack Manila
Sr. Software Engineer, RH OSP Storage


[1] https://docs.openstack.org/manila/latest/admin/cephfs_driver.html
[2] https://access.redhat.com/documentation/en-us/red_hat_ceph_storage/4/html/administration_guide/ceph-user-management
[3] https://opendev.org/openstack/manila/src/commit/7b15796aa5567868e30a6b2b80c57006cfa4f085/manila/share/drivers/cephfs/driver.py
[4] https://github.com/ceph/ceph/blob/c10a7240b657553c366fe62aca92e93d35b166e9/src/pybind/ceph_volume_client.py
[5] https://ceph.io/security/

Ana McTaggart

Red Hat Product Security

Red Hat Remote <https://www.redhat.com>


secalert@redhat.com for urgent response

This is a bug in Ceph. It affects:

* octopus (SES7)
* nautilus (SES6)
* luminous (SES5)

SES7 https://build.suse.de/request/show/233079
SES6 https://build.suse.de/request/show/233091

SUSE-SU-2020:3895-1: An update that solves one vulnerability and has four fixes is now available.

Category: security (important)
Bug References: 1178860,1179016,1179802,1180107,1180155
CVE References: CVE-2020-27781
JIRA References: 
Sources used:
SUSE Linux Enterprise Module for Basesystem 15-SP2 (src):    ceph-15.2.8.80+g1f4b6229ca-3.13.1
SUSE Enterprise Storage 7 (src):    ceph-15.2.8.80+g1f4b6229ca-3.13.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

openSUSE-SU-2020:2327-1: An update that solves one vulnerability and has four fixes is now available.

Category: security (important)
Bug References: 1178860,1179016,1179802,1180107,1180155
CVE References: CVE-2020-27781
JIRA References: 
Sources used:
openSUSE Leap 15.2 (src):    ceph-15.2.8.80+g1f4b6229ca-lp152.2.9.1, ceph-test-15.2.8.80+g1f4b6229ca-lp152.2.9.1

SUSE-SU-2021:0023-1: An update that solves one vulnerability and has 5 fixes is now available.

Category: security (moderate)
Bug References: 1178837,1179139,1179452,1179802,1180118,1180155
CVE References: CVE-2020-27781
JIRA References: 
Sources used:
SUSE Linux Enterprise Module for Basesystem 15-SP1 (src):    ceph-14.2.16.402+g7d47dbaf4d-3.57.1
SUSE Enterprise Storage 6 (src):    ceph-14.2.16.402+g7d47dbaf4d-3.57.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

openSUSE-SU-2021:0079-1: An update that solves one vulnerability and has 5 fixes is now available.

Category: security (moderate)
Bug References: 1178837,1179139,1179452,1179802,1180118,1180155
CVE References: CVE-2020-27781
JIRA References: 
Sources used:
openSUSE Leap 15.1 (src):    ceph-14.2.16.402+g7d47dbaf4d-lp151.2.31.1, ceph-test-14.2.16.402+g7d47dbaf4d-lp151.2.31.1

This fix was released in SES7 ceph Maintenance Update No. 3 (ses7-mu3)

*** Bug 1180155 has been marked as a duplicate of this bug. ***