CVE-2016-5009

The handle_command function in mon/Monitor.cc in Ceph allows remote authenticated users to cause a denial of service (segmentation fault and ceph monitor crash) via an (1) empty or (2) crafted prefix.

This update provides Ceph 10.2.3, which includes important bug fixes in RBD mirroring, RGW multi-site, CephFS, and RADOS.

Build/OPS:

• AArch64: Detect crc32 extension support from assembler. (bsc#999688)
• Drop legacy ceph RA which doesn't work with systemd unit files.
• The mount.ceph binary, which is used to mount CephFS pools, was moved to the ceph-common package so it can be run from any client.
• Accept bcache devices as data disks and fix partprobe intermittent issues during ceph-disk prepare.

CephFS:

• Several bug fixes for improved stability.

RBD:

• A number of fixes for RBD mirroring.
• Several bug fixes for improved stability.

RADOS:

• CVE-2016-5009: moncommand with empty prefix crashes monitor. (bsc#987144)
• Backports of many asyncmsgr fixes to jewel.
• Several bug fixes for improved OSD stability.
• Fix for a C++ symbol visibility issue in librados.

RGW:

• Fixes for number of issues related to syncing between remote sites.
• A number of other bug fixes, including fixes for:
  • IPv6
  • HTTPS/port 443 (bsc#990438)
  • radosgw-admin
  • Swift API
  • AWS4 API

For a full list of issues fixed in this release, see:

http://docs.ceph.com/docs/master/release-notes/#v10-2-3-jewel

This update for ceph fixes the following issues:

• CVE-2016-5009: moncommand with empty prefix could crash monitor [bsc#987144]
• Invalid commandd in SOC7 with ceph [bsc#1008894]
• Performance fix was missing in SES4 [bsc#1005179]
• ceph build problems on ppc64le [bsc#982141]
• ceph make build unit test failure [bsc#977940]
• ceph-deploy mon create-initial fails on one node [bsc#999688]
• MDS dies while running xfstests [bsc#985232]
• Typerror while calling _recover_auth_meta() [bsc#1008501]
• OSD daemon uses ~100% CPU load right after OSD creation / first OSD start [bsc#1014338]
• civetweb HTTPS support not working [bsc#990438]
• systemd is killing off OSDs [bsc#1007216]

It was discovered that Ceph incorrectly handled the handle_command function. A remote authenticated user could use this issue to cause Ceph to crash, resulting in a denial of service. (CVE-2016-5009)

Rahul Aggarwal discovered that Ceph incorrectly handled the authenticated-read ACL. A remote attacker could possibly use this issue to list bucket contents via a URL. (CVE-2016-7031)

Diluga Salome discovered that Ceph incorrectly handled certain POST objects with null conditions. A remote attacker could possibly use this issue to cuase Ceph to crash, resulting in a denial of service. (CVE-2016-8626)

Yang Liu discovered that Ceph incorrectly handled invalid HTTP Origin headers. A remote attacker could possibly use this issue to cuase Ceph to crash, resulting in a denial of service. (CVE-2016-9579)