Bug 2393864 (CVE-2025-30156)

A flaw was found in the CephX authentication protocol used by Ceph, a distributed storage system. CephX uses AES-128-CBC encryption with a hardcoded initialization vector and no message authentication (HMAC), making it vulnerable to the same class of unauthenticated-encryption attacks that compromised Kerberos 4 as documented in MIT's 2004 PERILS paper. An attacker who has compromised a single low-privilege CephX entity key can use the Ceph monitor as an encryption oracle by requesting tickets for specially-named entity identities over a standard network connection. The monitor encrypts these attacker-controlled names into ciphertext blocks which, due to absent integrity protection, can be spliced into forged credentials for privileged entities such as OSDs, MDSs, and MGRs. This grants cluster-wide access including data reads, data corruption, and full administrative control.