Bug 1179802 - (CVE-2020-27781) VUL-0: CVE-2020-27781: ceph: User credentials can be manipulated and stolen by Native CephFS consumers of OpenStack Manila
(CVE-2020-27781)
VUL-0: CVE-2020-27781: ceph: User credentials can be manipulated and stolen b...
Status: RESOLVED FIXED
: 1180155 (view as bug list)
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P2 - High : Major
: ---
Assigned To: Nathan Cutler
Security Team bot
https://smash.suse.de/issue/272926/
CVSSv3.1:SUSE:CVE-2020-27781:7.3:(AV:...
:
Depends on:
Blocks: 1180155
  Show dependency treegraph
 
Reported: 2020-12-09 06:27 UTC by Marcus Meissner
Modified: 2021-11-23 18:42 UTC (History)
5 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Comment 1 Marcus Meissner 2020-12-17 15:31:39 UTC
is public via oss-sec

From: Ana McTaggart <amctagga@redhat.com>
To: oss-security@lists.openwall.com
Subject: [oss-security] CVE-2020-27781 User credentials can be manipulated and stolen by Native CephFS consumers of OpenStack Manila


Dear all,
We have received a report of the following vulnerability affecting CephFS.
At Red Hat, we have assigned it CVE-2020-27781

We are proposing a public date of 12/16/2020, as suggested by the
reporter, but want to ensure agreement with upstream first.
I have included our original description of the flaw as follows.

Issue: User credentials can be manipulated and stolen by Native CephFS
consumers of OpenStack Manila

Products affected: RHCS 3.x, RHCS 4.x

Who reported this vulnerability:
   - Garbutt, John <john@johngarbutt.com>
   - Babel, Jahson <jahson.babel@cc.in2p3.fr>;
   - Pacha Ravi, Goutham <gouthamr@redhat.com>;

Details:

OpenStack Manila can provide users with Native CephFS shared file
systems [1]. When a user creates a "share" (short for "shared file
system") via Manila, a CephFS "subvolume" is created on the Ceph
cluster and exported to the manila user. After creating their share, a
user can specify who has access to the share with the help of "cephx"
client user names. A cephx client corresponds to Ceph Client Users
[2]. When access is provided, a client user key is returned via
manila. The interaction between manila and CephFS is driven by two
important parts:
 - The CephFS driver in manila [3]
 - The "ceph_volume_client" python interface driver in ceph [4]

The problem here is that OpenStack Manila users can request access to
a share to any arbitrary cephx user, including privileged pre-existing
users and the interface drivers will retrieve the access key of that
user along with providing access to the share. This access key is then
visible to all users of the OpenStack project that owns the share.
With the help of any prior capabilities of the pre-existing cephx
client user, an attacker has unintended access to the access key of
the user and can target any resource that the user has access to. An
attacker can even obtain the default ceph "admin" user's key in this
manner, and execute any commands as the ceph administrator.

Thanks,
Goutham Pacha Ravi
Project Technical Lead, OpenStack Manila
Sr. Software Engineer, RH OSP Storage


[1] https://docs.openstack.org/manila/latest/admin/cephfs_driver.html
[2] https://access.redhat.com/documentation/en-us/red_hat_ceph_storage/4/html/administration_guide/ceph-user-management
[3] https://opendev.org/openstack/manila/src/commit/7b15796aa5567868e30a6b2b80c57006cfa4f085/manila/share/drivers/cephfs/driver.py
[4] https://github.com/ceph/ceph/blob/c10a7240b657553c366fe62aca92e93d35b166e9/src/pybind/ceph_volume_client.py
[5] https://ceph.io/security/

Ana McTaggart

Red Hat Product Security

Red Hat Remote <https://www.redhat.com>


secalert@redhat.com for urgent response
Comment 2 Nathan Cutler 2020-12-18 10:13:54 UTC
This is a bug in Ceph. It affects:

* octopus (SES7)
* nautilus (SES6)
* luminous (SES5)
Comment 6 Swamp Workflow Management 2020-12-21 17:19:47 UTC
SUSE-SU-2020:3895-1: An update that solves one vulnerability and has four fixes is now available.

Category: security (important)
Bug References: 1178860,1179016,1179802,1180107,1180155
CVE References: CVE-2020-27781
JIRA References: 
Sources used:
SUSE Linux Enterprise Module for Basesystem 15-SP2 (src):    ceph-15.2.8.80+g1f4b6229ca-3.13.1
SUSE Enterprise Storage 7 (src):    ceph-15.2.8.80+g1f4b6229ca-3.13.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 7 Swamp Workflow Management 2020-12-25 17:15:21 UTC
openSUSE-SU-2020:2327-1: An update that solves one vulnerability and has four fixes is now available.

Category: security (important)
Bug References: 1178860,1179016,1179802,1180107,1180155
CVE References: CVE-2020-27781
JIRA References: 
Sources used:
openSUSE Leap 15.2 (src):    ceph-15.2.8.80+g1f4b6229ca-lp152.2.9.1, ceph-test-15.2.8.80+g1f4b6229ca-lp152.2.9.1
Comment 8 Swamp Workflow Management 2021-01-05 14:16:19 UTC
SUSE-SU-2021:0023-1: An update that solves one vulnerability and has 5 fixes is now available.

Category: security (moderate)
Bug References: 1178837,1179139,1179452,1179802,1180118,1180155
CVE References: CVE-2020-27781
JIRA References: 
Sources used:
SUSE Linux Enterprise Module for Basesystem 15-SP1 (src):    ceph-14.2.16.402+g7d47dbaf4d-3.57.1
SUSE Enterprise Storage 6 (src):    ceph-14.2.16.402+g7d47dbaf4d-3.57.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 9 Swamp Workflow Management 2021-01-16 14:37:27 UTC
openSUSE-SU-2021:0079-1: An update that solves one vulnerability and has 5 fixes is now available.

Category: security (moderate)
Bug References: 1178837,1179139,1179452,1179802,1180118,1180155
CVE References: CVE-2020-27781
JIRA References: 
Sources used:
openSUSE Leap 15.1 (src):    ceph-14.2.16.402+g7d47dbaf4d-lp151.2.31.1, ceph-test-14.2.16.402+g7d47dbaf4d-lp151.2.31.1
Comment 10 Nathan Cutler 2021-06-03 14:01:50 UTC
This fix was released in SES7 ceph Maintenance Update No. 3 (ses7-mu3)
Comment 11 Nathan Cutler 2021-06-03 14:02:19 UTC
*** Bug 1180155 has been marked as a duplicate of this bug. ***