Bug 1739292 (CVE-2019-10222) - CVE-2019-10222 ceph: Unauthenticated clients can crash ceph RGW configured with beast as frontend
Summary: CVE-2019-10222 ceph: Unauthenticated clients can crash ceph RGW configured wi...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2019-10222
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=moderate,reported=20190808,sou...
Depends On: 1746506 1739515
Blocks: 1739293
TreeView+ depends on / blocked
 
Reported: 2019-08-09 01:12 UTC by Pedro Sampaio
Modified: 2019-08-28 19:15 UTC (History)
27 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the Ceph RGW configuration with Beast as the front end handling client requests. An unauthenticated attacker could crash the Ceph RGW server by sending valid HTTP headers and terminating the connection, resulting in a remote denial of service for Ceph RGW clients.
Clone Of:
Environment:
Last Closed: 2019-08-28 19:07:24 UTC


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2019:2577 None None None 2019-08-28 17:00:01 UTC
Red Hat Product Errata RHSA-2019:2579 None None None 2019-08-28 18:58:32 UTC

Description Pedro Sampaio 2019-08-09 01:12:25 UTC
A flaw was found in ceph. Any single unauthenticated client can crash RGW if valid HTTP headers are sent and the connection is terminated.

References:

https://tracker.ceph.com/issues/40018

Comment 5 Joshua Padman 2019-08-14 04:00:04 UTC
Statement:

Red Hat OpenStack Platform 13 included some Ceph components at release for in order to support ppc64le. The version provided in the OpenStack repositories is outdated and customers are expected to be using versions provided in Ceph repositories now. Additionally, only the client side and libraries were included which are not affected by this vulnerability.

Comment 13 Nick Tait 2019-08-14 20:15:44 UTC
External References:

https://tracker.ceph.com/issues/40018

Comment 18 Pedro Sampaio 2019-08-28 13:08:11 UTC
Acknowledgments:

Name: Abhishek Lekshmanan (SUSE Software Solutions Germany)

Comment 20 Siddharth Sharma 2019-08-28 15:49:41 UTC
Mitigation:

To mitigate this issue either of the following options can be applied to system:

Mitigation 1:
1. By default system will use /etc/init.d/ceph-radosgw
   stop this service by

~]# /etc/init.d/ceph-radosgw stop

2. Create systemd service, and change command line parameters according to the environment
where Ceph radosgw is running.

~]# cat /usr/lib/systemd/system/ceph-rgw.service 
[Unit]
Description=Ceph RGW daemon

[Service]
Type=forking
ExecStart=/bin/radosgw -n client.rgw.$(HOSTNAME REDACTED)
Restart=on-abnormal
RestartSec=1s

[Install]
WantedBy=multi-user.target

3. Run systemd service 'ceph-rgw.service'

Caveat: It still takes +1-2 sec to get service back online. After applying above mentioned mitigation, the malicious IP can be blocked by a firewall rule if there are continuous attempts to launch remote denial of service. This mitigation is of limited use if the attack is launched from multiple IPs. It is recommended to limit the exposure of ceph RGW server to known clients.

OR 

Mitigation 2:
use 'civetweb' as HTTP frontend with ceph RGW.

Comment 21 Siddharth Sharma 2019-08-28 15:51:23 UTC
Created ceph tracking bugs for this issue:

Affects: fedora-all [bug 1746506]

Comment 22 errata-xmlrpc 2019-08-28 17:00:00 UTC
This issue has been addressed in the following products:

  Red Hat Ceph Storage 3.3 for Ubuntu 16.04

Via RHSA-2019:2577 https://access.redhat.com/errata/RHSA-2019:2577

Comment 23 errata-xmlrpc 2019-08-28 18:58:31 UTC
This issue has been addressed in the following products:

  Red Hat Ceph Storage 3 for Red Hat Enterprise Linux 7

Via RHSA-2019:2579 https://access.redhat.com/errata/RHSA-2019:2579

Comment 24 Product Security DevOps Team 2019-08-28 19:07:24 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-10222


Note You need to log in before you can comment on or make changes to this bug.