A flaw was found in the capabilities check of the rados block device functionality in the Linux kernel. Incorrect capability checks could alllow a local user with root priviledges (but no capabilities) to add or remove Rados Block Devices from the system.

Mitigation

As the rbd module can be loaded by a priviledged user or process, its use can be disabled by preventing the module from loading with the following instructions:

echo "install rbd /bin/true" >> /etc/modprobe.d/disable-rdb.conf

The system will need to be restarted if the modules isloaded. In most circumstances, the rbd kernel modules will be unable to be unloaded while in use.

If the system requires this module to work correctly, (Such as a CEPH node) this mitigation may not be suitable.

If you need further assistance, see KCS article <https://access.redhat.com/solutions/41278&gt; or contact Red Hat Global Support Services.