CVE-2020-27781: 
NixOS vulnerability analysis and mitigation

CVE-2020-27781 is a privilege escalation vulnerability discovered in Ceph that affects versions prior to 14.2.16, 15.x prior to 15.2.8, and 16.x prior to 16.2.0. The vulnerability allows user credentials to be manipulated and stolen by Native CephFS consumers of OpenStack Manila. The issue was discovered by Goutham Pacha Ravi (Red Hat), Jahson Babel (Centre de Calcul de l'IN2P3), and John Garbutt (StackHPC) (Bugzilla Report).

The vulnerability occurs when an OpenStack Manila user requests access to a share to an arbitrary cephx user, including existing privileged users. The interface drivers retrieve the access key along with providing access to the share, which becomes visible to all users of the OpenStack project that owns the share. The vulnerability has a CVSS v3.1 base score of 7.1 (High) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N (NVD Database).

The vulnerability enables an attacker to target any resource that the compromised user has access to, including administrative privileges. This could lead to complete system compromise if an admin user's credentials are stolen. The attacker can potentially access and manipulate any resource accessible by the stolen credentials (Ubuntu Security).

The vulnerability requires local access and low complexity to exploit. An attacker needs low privileges to initiate the attack, and no user interaction is required. The vulnerability can be exploited through the OpenStack Manila interface to gain unauthorized access to user credentials (NVD Database).

The vulnerability has been patched in Ceph versions 14.2.16, 15.2.8, and 16.2.0 and later. Users are advised to upgrade to these versions or later to mitigate the vulnerability. The fixes are implemented through commits 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05 and 7e3e4e73783a98bb07ab399438eb3aab41a6fc8b (Bugzilla Report).