CVE-2020-1700

What it actually does

Authenticated attacker triggers permanent socket connection leaks in radosgw via repeated unexpected disconnects, accumulating CLOSE_WAIT sockets until resource exhaustion occurs.

Why it matters to the business

Denial of service prevents legitimate users from accessing Ceph object storage, causing operational disruption and potential downtime until sockets are cleared or the service restarted.

How an attack unfolds

An authenticated user repeatedly initiates connections to the RGW Beast frontend and forces unexpected disconnects, causing the daemon to leak sockets; sustained abuse exhausts available resources and blocks new connections.

How to fix it

Upgrade Ceph to a release containing the socket-leak fix; apply vendor updates for Red Hat OpenShift Container Storage, openSUSE Leap, and Ubuntu Linux as they become available; restart radosgw after patching.

How to confirm the fix worked

Compare installed Ceph version against patched releases from upstream or distribution vendors; monitor netstat/ss output for persistent CLOSE_WAIT accumulation on radosgw ports; test service availability under load after upgrade.

Typical attack path

1. Obtain valid RGW credentials
2. Establish multiple concurrent connections to the Beast frontend
3. Force unexpected disconnects on each connection
4. Repeat the pattern at volume to accumulate leaked sockets
5. Continue until CLOSE_WAIT backlog exhausts file descriptors or memory

How to detect it

Review radosgw logs for repeated disconnect patterns from the same authenticated accounts; inspect system socket tables for abnormal CLOSE_WAIT counts tied to the radosgw process; correlate with authentication events during suspected abuse windows.

• radosgw.*CLOSE_WAIT
• multiple unexpected disconnects from authenticated RGW user
• file descriptor exhaustion in radosgw logs

What your security team should do

• Prioritize patching Ceph and dependent distributions as soon as fixed packages are released
• Implement connection-rate limiting or authentication throttling on RGW endpoints
• Add monitoring alerts for socket backlog and file-descriptor exhaustion on storage nodes