🟠 High  |  Source: Microsoft Security Response Center

CVE-2018-1128 is a flaw in the Ceph distributed storage authentication protocol (cephx) that fails to properly verify client identities, leaving it open to replay attacks. An attacker with network access to a Ceph cluster can capture and replay authentication packets to impersonate legitimate clients. This affects multiple Ceph branches including master, mimic, luminous, and jewel — relevant to Azure deployments using Ceph-backed storage.

Security Architect’s Take: Audit any Azure or self-managed environments using Ceph-backed storage and ensure the patched versions of Ceph are deployed; additionally, enforce network-level controls such as private VNets and NSGs to restrict access to Ceph cluster networks, limiting the attacker’s ability to sniff traffic.

Original advisory: CVE-2018-1128 It was found that cephx authentication protocol did not verify ceph clients correctly and was vulnerable to replay attack. Any attacker having access to ceph cluster network who is able to sniff packets on network can use this vulnerability to authenticate with ceph service and perform actions allowed by ceph service. Ceph branches master, mimic, luminous and jewel are believed to be vulnerable.