SB2023022857 - Multiple vulnerabilities in Ceph

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Incorrect default permissions (CVE-ID: CVE-2022-3650)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to ceph-crash.service runs the ceph-crash Python script with root privileges. The script is operating in the directory /var/lib/ceph/crash which is controlled by the unprivileged ceph user. A local user can inject arbitrary data into the crash dump and force the privileged script to write that file into an arbitrary location on the system, resulting in privilege escalation.

2) Input validation error (CVE-ID: CVE-2022-3854)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input when handling URL on RGW backends. A remote attacker can pass specially crafted URL to the application and perform a denial of service (DoS) attack.

Remediation

Install update from vendor's website.

References

• https://bugzilla.redhat.com/show_bug.cgi?id=2136909
• https://bugzilla.redhat.com/show_bug.cgi?id=2139925
• https://tracker.ceph.com/issues/55765
• https://bugzilla.suse.com/show_bug.cgi?id=1205025