Authentication Flaw in Ceph's Distributed Storage Platform

CVE-2025-30156

What is CVE-2025-30156?

The CephX authentication protocol in Ceph prior to version 20.2.4 and 19.2.6 is susceptible to a significant security flaw. The protocol uses AES-128-CBC in an unauthenticated manner that is compromised by a fixed initialization vector. This lack of proper encryption and message authentication allows attackers to forge authentication tickets, gaining unauthorized access to the Ceph cluster. An attacker can leverage this weakness to manipulate the encrypted data, effectively creating valid credentials for higher-privilege users such as Managers and OSDs. Furthermore, an attacker with minimal access can escalate privileges by altering a single bit in a service ticket, bypassing security measures. The issue has been addressed in the aforementioned releases, underscoring the importance of updating to ensure robust security.

References