SUSE update for ceph

Published: 2023-05-02

Risk	Medium
Patch available	YES
Number of vulnerabilities	3
CVE-ID	CVE-2022-0670 CVE-2022-3650 CVE-2022-3854
CWE-ID	CWE-264 CWE-276 CWE-20
Exploitation vector	Network
Public exploit	N/A
Vulnerable software Subscribe	SUSE Linux Enterprise Micro for Rancher Operating systems & Components / Operating system SUSE Linux Enterprise Micro Operating systems & Components / Operating system librbd1-debuginfo Operating systems & Components / Operating system package or component ceph-debugsource Operating systems & Components / Operating system package or component librados2-debuginfo Operating systems & Components / Operating system package or component librbd1 Operating systems & Components / Operating system package or component librados2 Operating systems & Components / Operating system package or component
Vendor	SUSE

Security Bulletin

This security bulletin contains information about 3 vulnerabilities.

1) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU66440

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-0670

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote user to escalate privileges on the system.

The vulnerability exists due to an error within the "volumes" plugin in Ceph Manager. The Openstack manilla owning a Ceph File system "share" enables the owner to read/write any manilla share or entire file system.

Mitigation

Update the affected package ceph to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Micro for Rancher: 5.4

SUSE Linux Enterprise Micro: 5.4

librbd1-debuginfo: before 16.2.11.58+g38d6afd3b78-150400.3.6.1

ceph-debugsource: before 16.2.11.58+g38d6afd3b78-150400.3.6.1

librados2-debuginfo: before 16.2.11.58+g38d6afd3b78-150400.3.6.1

librbd1: before 16.2.11.58+g38d6afd3b78-150400.3.6.1

librados2: before 16.2.11.58+g38d6afd3b78-150400.3.6.1

External links

http://www.suse.com/support/update/announcement/2023/suse-su-20231581-2/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Incorrect default permissions

EUVDB-ID: #VU72630

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-3650

CWE-ID: CWE-276 - Incorrect Default Permissions

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to ceph-crash.service runs the ceph-crash Python script with root privileges. The script is operating in the directory /var/lib/ceph/crash which is controlled by the unprivileged ceph user. A local user can inject arbitrary data into the crash dump and force the privileged script to write that file into an arbitrary location on the system, resulting in privilege escalation.

Mitigation

Update the affected package ceph to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Micro for Rancher: 5.4

SUSE Linux Enterprise Micro: 5.4

librbd1-debuginfo: before 16.2.11.58+g38d6afd3b78-150400.3.6.1

ceph-debugsource: before 16.2.11.58+g38d6afd3b78-150400.3.6.1

librados2-debuginfo: before 16.2.11.58+g38d6afd3b78-150400.3.6.1

librbd1: before 16.2.11.58+g38d6afd3b78-150400.3.6.1

librados2: before 16.2.11.58+g38d6afd3b78-150400.3.6.1

External links

http://www.suse.com/support/update/announcement/2023/suse-su-20231581-2/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Input validation error

EUVDB-ID: #VU74055

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-3854

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input when handling URL on RGW backends. A remote attacker can pass specially crafted URL to the application and perform a denial of service (DoS) attack.

Mitigation

Update the affected package ceph to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Micro for Rancher: 5.4

SUSE Linux Enterprise Micro: 5.4

librbd1-debuginfo: before 16.2.11.58+g38d6afd3b78-150400.3.6.1

ceph-debugsource: before 16.2.11.58+g38d6afd3b78-150400.3.6.1

librados2-debuginfo: before 16.2.11.58+g38d6afd3b78-150400.3.6.1

librbd1: before 16.2.11.58+g38d6afd3b78-150400.3.6.1

librados2: before 16.2.11.58+g38d6afd3b78-150400.3.6.1

External links

http://www.suse.com/support/update/announcement/2023/suse-su-20231581-2/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.