CVE-2024-47866: Red Hat Ceph Storage DoS Vulnerability

CVE-2024-47866 Overview

CVE-2024-47866 affects Ceph, a distributed object, block, and file storage platform widely deployed for scalable storage infrastructure. The vulnerability impacts the RADOS Gateway (RGW) daemon, which provides S3 and Swift-compatible object storage interfaces. An unauthenticated attacker can crash the RGW daemon by issuing a PUT object request with the x-amz-copy-source header set to an empty string. This input validation failure [CWE-20] results in a denial of service condition affecting object storage availability. The flaw exists in all versions up to and including 19.2.3.

Critical Impact
A remote, unauthenticated attacker can crash the RGW daemon over the network, taking S3-compatible object storage services offline.

Affected Products

Red Hat Ceph (all versions up to and including 19.2.3)
Ceph RADOS Gateway (RGW) component
Deployments exposing S3-compatible object storage endpoints

Discovery Timeline

2025-11-12 - CVE-2024-47866 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-47866

Vulnerability Analysis

The vulnerability resides in the Ceph RGW daemon's handling of the S3 x-amz-copy-source header during PUT object operations. The header normally specifies the source bucket and key when copying an object server-side. When an attacker submits a PUT request with x-amz-copy-source set to an empty string, the daemon fails to validate the input properly and crashes. The crash terminates the RGW process, disrupting all S3 and Swift API operations served by that daemon. Because RGW frequently fronts production object storage workloads, a successful attack disables backup repositories, application data stores, and platform services.

Root Cause

The root cause is improper input validation [CWE-20] in the RGW request parser. The code path that resolves the copy source object does not verify that the header value is non-empty before dereferencing or parsing it. The resulting fault propagates upward and terminates the daemon. No authentication or authorization is required to trigger the condition because the parsing occurs before access control checks complete.

Attack Vector

The attack is delivered over the network against any reachable RGW endpoint. An attacker sends an HTTP PUT request to an object URL and includes the x-amz-copy-source header with an empty value. The daemon processes the malformed header and crashes. Repeated requests against an automatically restarted daemon produce a sustained denial of service. The flaw description in the GitHub Security Advisory confirms that no patched versions existed at the time of publication. See the Ceph GitHub Security Advisory and the Openwall OSS Security discussion for technical details.

Detection Methods for CVE-2024-47866

Indicators of Compromise

RGW daemon crashes or unexpected restarts correlated with inbound S3 PUT requests
HTTP PUT requests containing an x-amz-copy-source header with an empty value
Repeated 5xx responses or connection resets from RGW endpoints during the same time window
Stack traces in RGW logs referencing copy source parsing functions

Detection Strategies

Inspect web access logs and reverse proxy logs for PUT requests where x-amz-copy-source is present but empty
Monitor systemd or container orchestrator events for repeated ceph-radosgw process restarts
Alert on bursts of malformed S3 API requests originating from a single source address
Correlate RGW daemon termination events with concurrent HTTP request patterns

Monitoring Recommendations

Forward RGW access and error logs to a centralized logging platform for query and alerting
Establish baselines for RGW process uptime and trigger alerts on abnormal restart frequency
Track availability metrics on the S3 API endpoint from external probes
Enable rate limiting telemetry on load balancers fronting the RGW service

How to Mitigate CVE-2024-47866

Immediate Actions Required

Restrict network access to RGW endpoints so only trusted clients can reach the S3 API
Deploy a web application firewall or reverse proxy rule that rejects PUT requests carrying an empty x-amz-copy-source header
Enable automatic daemon restart and process supervision to reduce outage duration if a crash occurs
Track the upstream Ceph project for a patched release and plan an upgrade window

Patch Information

At the time of CVE publication, no patched versions of Ceph existed for this issue. Administrators should monitor the Ceph GitHub Security Advisory GHSA-mgrm-g92q-f8h8 and the Red Hat security portal for fix availability. Apply vendor updates immediately once released and validate RGW behavior in a staging environment before production rollout.

Workarounds

Filter or normalize the x-amz-copy-source header at an upstream proxy and drop requests where the value is empty
Place RGW behind authenticated ingress so unauthenticated clients cannot reach the vulnerable code path
Run multiple RGW daemons behind a load balancer so a single crash does not disable the service
Apply strict rate limiting on PUT requests to slow exploitation attempts

bash

# Example NGINX rule to reject empty x-amz-copy-source headers
map $http_x_amz_copy_source $block_empty_copy_source {
    ""        0;
    default   0;
}

server {
    listen 443 ssl;
    server_name s3.example.com;

    if ($http_x_amz_copy_source ~ "^$") {
        return 400;
    }

    location / {
        proxy_pass http://rgw_backend;
    }
}