CVE-2025-30156
Description
A flaw was found in the CephX authentication protocol used by Ceph, a distributed storage system. CephX uses AES-128-CBC encryption with a hardcoded initialization vector and no message authentication (HMAC), making it vulnerable to the same class of unauthenticated-encryption attacks that compromised Kerberos 4 as documented in MIT's 2004 PERILS paper. An attacker who has compromised a single low-privilege CephX entity key can use the Ceph monitor as an encryption oracle by requesting tickets for specially-named entity identities over a standard network connection. The monitor encrypts these attacker-controlled names into ciphertext blocks which, due to absent integrity protection, can be spliced into forged credentials for privileged entities such as OSDs, MDSs, and MGRs. This grants cluster-wide access including data reads, data corruption, and full administrative control.
Statement
The Red Hat Product Security team has assessed the severity of this vulnerability as Important, given that exploitation requires a compromised low-privilege CephX entity key and network access to a Ceph monitor. Successful exploitation allows an attacker to forge credentials for any privileged Ceph entity, gaining full cluster-wide access including data reads, data corruption, and administrative control over OSDs, MDSs, and MGRs. The vulnerability's root cause is the use of unauthenticated AES-128-CBC encryption with a hardcoded initialization vector in the CephX protocol, a cryptographic design weakness identical to the one that rendered Kerberos 4 insecure.
Mitigation
To mitigate this issue, Red Hat recommends isolating the Ceph messenger protocol to dedicated internal networks with strict access controls, limiting exposure to potential attackers. Administrators should audit and minimize the number of CephX client credentials in circulation and enforce strong credential management to reduce the risk of low-privilege key compromise. Where possible, deploy msgr2 with on-wire encryption to reduce passive sniffing exposure. It is strongly advised to apply vendor-supplied patches as soon as they are released, upgrade to fixed Ceph versions (Tentacle 20.2.4 or later), and rotate all CephX keys to the new AES-256-CTS-HMAC-SHA384-192 cipher type, prioritizing server-side keys.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.7 | N/A | 8.9 |
| Attack Vector | Network | N/A | Adjacent Network |
| Attack Complexity | High | N/A | Low |
| Privileges Required | None | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Changed | N/A | Changed |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | None | N/A | Low |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
cve.org: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Application Data
If the IV is not properly initialized, data that is encrypted can be compromised and information about the data can be leaked. See [REF-1179].
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
