In ceph-mon daemon, the "kludge" for older clients in handle_command() allows any authenticated client access to the three whitelisted commands. An attacker with "mon r" caps can exploit this, e.g. to change configuration parameters using injectargs. For ceph-mgr daemon, in handle_command(MCommand), messages are queued to adminsocket without access checks if fsid is present. This can be exploited by an attacker without manager caps to run any MCommand including "config set".
Name: Olle Segerdahl
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
This vulnerability affects Ceph versions 15.2.0 and later. The following products do not ship the flawed versions and are therefore not affected by this flaw:
* Red Hat Ceph Storage
* Red Hat OpenStack Platform