CVE-2019-10222

Impact:
Important
Public Date:
2019-08-28
CWE:
CWE-400
Bugzilla:
1739292: CVE-2019-10222 ceph: Unauthenticated clients can crash ceph RGW configured with beast as frontend
A flaw was found in the Ceph RGW configuration with Beast as the front end handling client requests. An unauthenticated attacker could crash the Ceph RGW server by sending valid HTTP headers and terminating the connection, resulting in a remote denial of service for Ceph RGW clients.

Find out more about CVE-2019-10222 from the MITRE CVE dictionary dictionary and NIST NVD.

Statement

Red Hat OpenStack Platform 13 included some Ceph components at release for in order to support ppc64le. The version provided in the OpenStack repositories is outdated and customers are expected to be using versions provided in Ceph repositories now. Additionally, only the client side and libraries were included which are not affected by this vulnerability.

CVSS v3 metrics

CVSS3 Base Score 7.5
CVSS3 Base Metrics CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality None
Integrity Impact None
Availability Impact High

Red Hat Security Errata

Platform Errata Release Date
Red Hat Ceph Storage 3 for Red Hat Enterprise Linux 7 (ceph) RHSA-2019:2577 2019-08-28
Red Hat Ceph Storage 3 for Ubuntu RHSA-2019:2579 2019-08-28

Affected Packages State

Platform Package State
Red Hat OpenStack Platform 13.0 (Queens) ceph Not affected
Red Hat Enterprise Linux 8 ceph Not affected
Red Hat Enterprise Linux 7 ceph-common Not affected
Red Hat Ceph Storage 2 ceph Not affected
Unless explicitly stated as not affected, all previous versions of packages in any minor update stream of a product listed here should be assumed vulnerable, although may not have been subject to full analysis.

Acknowledgements

Red Hat would like to thank Abhishek Lekshmanan (SUSE Software Solutions Germany) for reporting this issue.

Mitigation

To mitigate this issue either of the following options can be applied to system:

Mitigation 1:
1. By default system will use /etc/init.d/ceph-radosgw
   stop this service by

~]# /etc/init.d/ceph-radosgw stop

2. Create systemd service, and change command line parameters according to the environment
where Ceph radosgw is running.

~]# cat /usr/lib/systemd/system/ceph-rgw.service
[Unit]
Description=Ceph RGW daemon

[Service]
Type=forking
ExecStart=/bin/radosgw -n client.rgw.$(HOSTNAME REDACTED)
Restart=on-abnormal
RestartSec=1s

[Install]
WantedBy=multi-user.target

3. Run systemd service 'ceph-rgw.service'

Caveat: It still takes +1-2 sec to get service back online. After applying above mentioned mitigation, the malicious IP can be blocked by a firewall rule if there are continuous attempts to launch remote denial of service. This mitigation is of limited use if the attack is launched from multiple IPs. It is recommended to limit the exposure of ceph RGW server to known clients.

OR

Mitigation 2:
use 'civetweb' as HTTP frontend with ceph RGW.

External References

Last Modified