RHSA-2021:1452 - Security Advisory

Topic

An update for ceph, ceph-ansible, gperftools, and tcmu-runner is now available for Red Hat Ceph Storage 4.2.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat Ceph Storage is a scalable, open, software-defined storage platform that combines the most stable version of the Ceph storage system with a Ceph management platform, deployment utilities, and support services.

The ceph-ansible package provides Ansible playbooks for installing, maintaining, and upgrading Red Hat Ceph Storage.

Perf Tools is a collection of performance analysis tools, including a high performance multi-threaded malloc() implementation that works particularly well with threads and STL, a thread-friendly heap-checker, a heap profiler, and a cpu-profiler.

The tcmu-runner packages provide a service that handles the complexity of the LIO kernel target's userspace passthrough interface (TCMU). It presents a C plugin API for extension modules that handle SCSI requests in ways not possible or suitable to be handled by LIO's in-kernel backstores.

Security Fix(es):

• tcmu-runner: SCSI target (LIO) write to any block on ILO backstore (CVE-2021-3139)
• ceph: mgr modules' passwords are in clear text in mgr logs (CVE-2020-25678)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

These updated packages include numerous bug fixes. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat Ceph Storage 4.2 Release Notes for information on the most significant of these changes:

https://access.redhat.com/documentation/en-us/red_hat_ceph_storage/4.2/html/release_notes/index

All users of Red Hat Ceph Storage are advised to upgrade to these updated
packages, which provide numerous bug fixes.

Solution

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 7 x86_64
• Red Hat Ceph Storage MON 4 for RHEL 8 x86_64
• Red Hat Ceph Storage MON 4 for RHEL 7 x86_64
• Red Hat Ceph Storage OSD 4 for RHEL 8 x86_64
• Red Hat Ceph Storage OSD 4 for RHEL 7 x86_64
• Red Hat Enterprise Linux for x86_64 8 x86_64
• Red Hat Ceph Storage for Power 4 for RHEL 8 ppc64le
• Red Hat Ceph Storage for Power 4 for RHEL 7 ppc64le
• Red Hat Ceph Storage MON for Power 4 for RHEL 8 ppc64le
• Red Hat Ceph Storage MON for Power 4 for RHEL 7 ppc64le
• Red Hat Ceph Storage OSD for Power 4 for RHEL 8 ppc64le
• Red Hat Ceph Storage OSD for Power 4 for RHEL 7 ppc64le
• Red Hat Ceph Storage for IBM z Systems 4 s390x
• Red Hat Ceph Storage MON for IBM z Systems 4 s390x
• Red Hat Ceph Storage OSD for IBM z Systems 4 s390x

Fixes

• BZ - 1831779 - [RFE] RGW Multi-site data sync optimizations
• BZ - 1831798 - [RFE] RGW Multisite sync data logs omap offload
• BZ - 1859257 - radosgw-admin user stats --reset-stats causing OSD flapping when issued against users with thousands of buckets
• BZ - 1867717 - Every time ceph-volume command gets executed the debug output gets registered here: /var/log/ceph/ceph-volume.log
• BZ - 1873881 - When Kafka Cluster is unavailable, Bucket access is not available after setting up Bucket Notification feature.
• BZ - 1875346 - rgw lc expiration header returns although it should not
• BZ - 1875777 - Filestore to Bluestore migration skipped if osd_objectstore is not set to "filestore"
• BZ - 1876827 - [cee/sd][ceph-volume] "ceph-volume lvm batch --report /dev/vdd " fails on lvm OSDs set up with dm-cache
• BZ - 1881304 - [GSS] [RFE] Log indication of latency by bucket
• BZ - 1882561 - Add per pool compression metrics to mgr/prometheus
• BZ - 1884469 - Log files are created after installation with rights root:root
• BZ - 1885441 - mgr/prometheus should provide a metric indicating SLOW_OPS for alerting
• BZ - 1888630 - [ceph-ansible]: Multi realm create workflow fails on restart RGW step
• BZ - 1892109 - CVE-2020-25678 ceph: mgr modules' passwords are in clear text in mgr logs
• BZ - 1892265 - [RGW] bucket list fails with ERROR: get_bucket_instance_from_oid failed: -5
• BZ - 1892824 - [RFE][ceph-mgr][ceph-dashboard] Backport request to display the user's current bucket quota usage in RHCS4 ceph-dashboard
• BZ - 1901543 - [ceph-ansible] Permissions set incorrectly on the dashboard alerting directory
• BZ - 1901865 - [ceph-ansible] : switch from rpm to containerized - services collocated with OSDs are stopped creating failure in case of failure
• BZ - 1901973 - [GSS][RGW] S3 error: 404 (NoSuchBucket) due to cache hit (negative entry)
• BZ - 1903990 - [GSS][RFE] backport request for beast frontend option to set the request_timeout_ms
• BZ - 1908910 - [RFE] - Tool to identify objects impacted by BZ 1892644
• BZ - 1909176 - [RFE] rgw: make libcurl buffer size configurable
• BZ - 1912454 - "rbd mirror snapshot schedule status" command is not listing any output
• BZ - 1912538 - [rgw] S3 PUT objects using Camel throws signature of last chunk does not match
• BZ - 1915478 - [RFE][Ceph-Ansible] Support configuring of multiple RGW endpoints from multiple node in ceph-ansible for RGW multisite
• BZ - 1916045 - CVE-2021-3139 tcmu-runner: SCSI target (LIO) write to any block on ILO backstore
• BZ - 1917374 - [ceph tracker]When OCS was deployed using arbiter mode mon's are going into CLBO state, ceph version = 14.2.11-95
• BZ - 1917687 - `radosgw-admin datalog list` is giving error - 'failed to list data_log.XX No such file or directory'
• BZ - 1919102 - [RGW MS - MultiSite] : Admin/User should be able offload sync data log omap (change 'rgw_data_log_backing') in production cluster without any down time
• BZ - 1919123 - [RGW MS] post data sync log omap offload, OSD log has error - /cls_fifo.cc...Zero length object, returning ENODATA
• BZ - 1919201 - [RGW][MS]: with rgw_data_log_backing set to fifo, sync fails with "failed to read remote data log info: ret=-22"
• BZ - 1919294 - [RGW-Multisite]: 'radosgw-admin datalog list' throws ERROR: list_bi_log_entries(): (38) Function not implemented
• BZ - 1919416 - 4.2 deployment alters osd_memory_target
• BZ - 1919956 - [rgw] S3 PUT objects using Camel throws signature of last chunk does not match
• BZ - 1921829 - [RADOS-MGR] - Mgr services are crashing : Caught signal (Segmentation fault) ** in thread 7ff02eaa2700 thread_name:mgr-fin
• BZ - 1922998 - [ceph-ansible][upgrade][rgw]: multisite upgrade on secondary fails at task 'check if the realm system user already exists]'
• BZ - 1925247 - typo in the condition of the zonegroup list creation task
• BZ - 1925350 - prometheus, alertmanager and node-exporter images which use in the latest Ceph Storage have the "D" health index.
• BZ - 1925650 - Link ceph to tcmalloc on s390x
• BZ - 1925651 - Link ceph to tcmalloc on ppc64le
• BZ - 1927719 - [GSS][ceph-dashboard] cherrypy reveals it's versions in header and error pages
• BZ - 1928019 - [RGW MS] Buckets are not syncing between the clusters after deploying RGW miltisite cluster using ceph-ansible
• BZ - 1928268 - [RADOS-MGR] : Module 'rbd_support' has failed: Not found or unloadable
• BZ - 1929064 - [cee/sd][mgr][prometheus] Ceph mgr prometheus pluging cotain stripped/incomplete ipv6 address
• BZ - 1929714 - [GSS] RESTful APIs failing with 500 Internal Server Error
• BZ - 1930164 - [Ceph-Ansible] [Container] Upgrade failed at the TASK [get osd versions] with msg: '[Errno 2] No such file or directory: b''ceph'': b''ceph'''
• BZ - 1931365 - ceph-dashboard : create dashboard admin user fails with: Missing CNI default network
• BZ - 1931441 - [RGW][notification]: create topic with peristent flag fails with error: -1
• BZ - 1931494 - [RGW MS] Buckets created on secondary are fully not syncing to primary site
• BZ - 1932175 - [RGW][MS][Notification]: with persistent=true flag set in topic, notification is not generated on kafka server
• BZ - 1932780 - mgr/dashboard: delete EOF when reading passwords from file
• BZ - 1932848 - Unable to change the pool Name
• BZ - 1933963 - [RGW][notification][kafka]: with kafka-ack-level=none and persistent flag set, only first notification is sent
• BZ - 1936210 - rbd example from the docs crashes with ceph_assert(weight == 10)
• BZ - 1936647 - [RGW] Using LDAP with HDP/S3A unable to put objects
• BZ - 1937088 - When Performed add capacity over arbiter mode cluster ceph health reports PG_AVAILABILITY Reduced data availability: 25 pgs inactive, 25 pgs incomplete
• BZ - 1937997 - ceph-ansible fails on RHOS 16.1.3 with msg: 'dict object' has no attribute 'mons' when using Manila with Ganesha and external Ceph
• BZ - 1938105 - [RGW][MS]: multiple crashes seen on reducing rgw_data_log_num_shards to 64
• BZ - 1938669 - setuid and setgid file bits are not retained after CephFS snapshot restore
• BZ - 1939766 - [Arbiter] Disable mon failover in a stretch cluster for 4.7
• BZ - 1942142 - RHCS4.2 to 4.2z-stream upgrade failed on ceph_assert of old code
• BZ - 1943471 - [Ceph-Ansible] [Container] ceph-crash container services not getting upgraded to newer version
• BZ - 1944611 - [Arbiter] When Performed zone(zone=a) Power off and Power On, 3 mon pod(zone=b,c) goes in CLBO after node Power off and 2 Osd(zone=a) goes in CLBO after node Power on
• BZ - 1947142 - rgw: multisite: fix crash in DataLogBackends::list
• BZ - 1949166 - OCS 4.7 Arbiter Mode Cluster becomes stuck when entire zone is shutdown

CVEs

• CVE-2020-25678
• CVE-2021-3139

References

• https://access.redhat.com/security/updates/classification/#important