CVE-2021-3979

ceph: Ceph volume does not honour osd_dmcrypt_key_size

Severity Score

6.5

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

A key length flaw was found in Red Hat Ceph Storage. An attacker can exploit the fact that the key length is incorrectly passed in an encryption algorithm to create a non random key, which is weaker and can be exploited for loss of confidentiality and integrity on encrypted disks.

Se ha encontrado un fallo de longitud de clave en Red Hat Ceph Storage. Un atacante puede explotar el hecho de que la longitud de la clave se pasa incorrectamente en un algoritmo de cifrado para crear una clave no aleatoria, que es más débil y puede ser explotada para la pérdida de confidencialidad e integridad en los discos cifrados.

*Credits: N/A

CVSS Scores

NISTv3.1 6.5

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2021-11-19 CVE Reserved
2022-04-05 CVE Published
2024-03-17 EPSS Updated
2024-08-03 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-287: Improper Authentication
CWE-327: Use of a Broken or Risky Cryptographic Algorithm

CAPEC

References (7)

URL	Tag	Source
https://lists.debian.org/debian-lts-announce/2023/10/msg00034.html

URL	Date	SRC

URL	Date	SRC
https://github.com/ceph/ceph/commit/47c33179f9a15ae95cc1579a421be89378602656	2023-10-23
https://github.com/ceph/ceph/pull/44765	2023-10-23

URL	Date	SRC
https://access.redhat.com/security/cve/CVE-2021-3979	2022-05-05
https://bugzilla.redhat.com/show_bug.cgi?id=2024788	2022-05-05
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BPOK44BESMIFW6BIOGCN452AKKOIIT6Q	2023-10-23
https://tracker.ceph.com/issues/54006	2023-10-23

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Redhat Search vendor "Redhat"	Ceph Storage Search vendor "Redhat" for product "Ceph Storage"	4.0 Search vendor "Redhat" for product "Ceph Storage" and version "4.0"	-	Affected	in	Redhat Search vendor "Redhat"	Enterprise Linux Search vendor "Redhat" for product "Enterprise Linux"	8.0 Search vendor "Redhat" for product "Enterprise Linux" and version "8.0"	-	Safe
Redhat Search vendor "Redhat"	Ceph Storage Search vendor "Redhat" for product "Ceph Storage"	5.0 Search vendor "Redhat" for product "Ceph Storage" and version "5.0"	-	Affected	in	Redhat Search vendor "Redhat"	Enterprise Linux Search vendor "Redhat" for product "Enterprise Linux"	8.0 Search vendor "Redhat" for product "Enterprise Linux" and version "8.0"	-	Safe
Redhat Search vendor "Redhat"	Ceph Storage For Power Search vendor "Redhat" for product "Ceph Storage For Power"	4.0 Search vendor "Redhat" for product "Ceph Storage For Power" and version "4.0"	-	Affected	in	Redhat Search vendor "Redhat"	Enterprise Linux Search vendor "Redhat" for product "Enterprise Linux"	8.0 Search vendor "Redhat" for product "Enterprise Linux" and version "8.0"	-	Safe
Redhat Search vendor "Redhat"	Ceph Storage Search vendor "Redhat" for product "Ceph Storage"	4.0 Search vendor "Redhat" for product "Ceph Storage" and version "4.0"	-	Affected	in	Redhat Search vendor "Redhat"	Enterprise Linux Search vendor "Redhat" for product "Enterprise Linux"	7.0 Search vendor "Redhat" for product "Enterprise Linux" and version "7.0"	-	Safe
Redhat Search vendor "Redhat"	Ceph Storage Search vendor "Redhat" for product "Ceph Storage"	5.0 Search vendor "Redhat" for product "Ceph Storage" and version "5.0"	-	Affected	in	Redhat Search vendor "Redhat"	Enterprise Linux Search vendor "Redhat" for product "Enterprise Linux"	7.0 Search vendor "Redhat" for product "Enterprise Linux" and version "7.0"	-	Safe
Redhat Search vendor "Redhat"	Ceph Storage For Power Search vendor "Redhat" for product "Ceph Storage For Power"	4.0 Search vendor "Redhat" for product "Ceph Storage For Power" and version "4.0"	-	Affected	in	Redhat Search vendor "Redhat"	Enterprise Linux Search vendor "Redhat" for product "Enterprise Linux"	7.0 Search vendor "Redhat" for product "Enterprise Linux" and version "7.0"	-	Safe
Redhat Search vendor "Redhat"		Ceph Storage Search vendor "Redhat" for product "Ceph Storage"				3.0 Search vendor "Redhat" for product "Ceph Storage" and version "3.0"		-		Affected
Redhat Search vendor "Redhat"		Ceph Storage Search vendor "Redhat" for product "Ceph Storage"				4.3 Search vendor "Redhat" for product "Ceph Storage" and version "4.3"		-		Affected
Redhat Search vendor "Redhat"		Ceph Storage Search vendor "Redhat" for product "Ceph Storage"				5.1 Search vendor "Redhat" for product "Ceph Storage" and version "5.1"		-		Affected
Redhat Search vendor "Redhat"		Openshift Container Storage Search vendor "Redhat" for product "Openshift Container Storage"				4.0 Search vendor "Redhat" for product "Openshift Container Storage" and version "4.0"		-		Affected
Redhat Search vendor "Redhat"		Openshift Data Foundation Search vendor "Redhat" for product "Openshift Data Foundation"				4.0 Search vendor "Redhat" for product "Openshift Data Foundation" and version "4.0"		-		Affected
Redhat Search vendor "Redhat"		Openstack Platform Search vendor "Redhat" for product "Openstack Platform"				13.0 Search vendor "Redhat" for product "Openstack Platform" and version "13.0"		-		Affected
Redhat Search vendor "Redhat"		Ceph Storage For Ibm Z Systems Search vendor "Redhat" for product "Ceph Storage For Ibm Z Systems"				4.0 Search vendor "Redhat" for product "Ceph Storage For Ibm Z Systems" and version "4.0"		-		Affected
Fedoraproject Search vendor "Fedoraproject"		Fedora Search vendor "Fedoraproject" for product "Fedora"				35 Search vendor "Fedoraproject" for product "Fedora" and version "35"		-		Affected
Fedoraproject Search vendor "Fedoraproject"		Fedora Search vendor "Fedoraproject" for product "Fedora"				37 Search vendor "Fedoraproject" for product "Fedora" and version "37"		-		Affected