Bug 1515872 (CVE-2017-16818)

Summary:	CVE-2017-16818 ceph: Failed assertion through user input in ceph_assert() function in rgw_iam_policy.cc
Product:	[Other] Security Response	Reporter:	Pedro Sampaio <psampaio>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	apevec, branto, chrisw, danmick, david, extras-orphan, fedora, icolle, i, jdurgin, jjoyce, jonathan, josef, jschluet, kbasil, kdreyer, kkeithle, lhh, loic, lpeer, markmc, mburns, nlevine, ramkrsna, rbryant, sclewis, security-response-team, sisharma, slinaber, srevivo, steve, tdecacqu
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2017-11-21 15:13:51 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1515895, 1515896
Bug Blocks:	1500503

Description Pedro Sampaio 2017-11-21 14:10:10 UTC

A flaw was discovered in ceph. Assertion in rgw_iam_policy.cc can be reached by user input and fail through data passed in from a rest call causing it to crash.

Upstream patch:

https://github.com/ceph/ceph/commit/b3118cabb8060a8cc6a01c4e8264cb18e7b1745a

Comment 1 Pedro Sampaio 2017-11-21 14:58:30 UTC

Created ceph tracking bugs for this issue:

Affects: epel-6 [bug 1515896]
Affects: fedora-all [bug 1515895]

Comment 2 Siddharth Sharma 2017-11-21 15:05:16 UTC

Analysis:

Red Hat Ceph Storage 1.3 and Red Hat Ceph Storage 2 are not affected by this flaw as bucket policy is not supported in ceph version shipped with these products.