Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

ceph/ceph

              main @ bb97bfa
            

Fixes

CVEs

CRITICAL

Peak severity

54.2%

Coverage

Highlights

Auth Bypass: 12 prior fixes. Scrutinize any change in this area.

src/mon/AuthMonitor.cc: most-fixed (3 issues). Treat as high-risk during review.

20 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: The largest class of fixes, with multiple distinct bypass mechanisms: fall-through in reclaim_session, inverted MFA checks, missing canonical headers in SigV4, capability checks after subscription processing, and insufficient validation of cluster connection parameters. Historical CVEs (CVE-2018-10861, CVE-2020-10736) confirm monitor authorization bypasses.

Cryptographic Weakness: Cephx protocol has a history of replay (CVE-2018-1128, CVE-2020-25660) and signature bypass (CVE-2018-1129) flaws. Fixes add usage constants to prevent ticket forgery, switch to HMAC-SHA256, and add a cipher allowlist. Nonce reuse in RGW re-encryption (CVE-2020-1759, commit 75f81837) is a critical AEAD failure.

Denial of Service: Multiple crash and resource-exhaustion vectors: use-after-free in DispatchQueue, negative fd indexing in RDMA, watcher thread leaks in Rook, and alignment traps in cephx. Historical CVEs show RGW DoS via malformed requests (CVE-2024-47866, CVE-2021-3531, CVE-2019-10222, CVE-2018-7262).