Permissions, Privileges, and Access Controls in Ceph - CVE-2022-0670

Vulnerability identifier: #VU66440

CSH Severity: Medium

CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-0670

CWE-ID: CWE-264

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to escalate privileges on the system.

The vulnerability exists due to an error within the "volumes" plugin in Ceph Manager. The Openstack manilla owning a Ceph File system "share" enables the owner to read/write any manilla share or entire file system.

Ceph
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
openSUSE Leap Micro
SUSE Enterprise Storage
Red Hat Enterprise Linux for x86_64
Basesystem Module
openSUSE Leap
Ubuntu
openEuler
Fedora
Red Hat Ceph Storage
libunwind (Red Hat package)
leveldb (Red Hat package)
oath-toolkit (Red Hat package)
gperftools (Red Hat package)
ceph (Ubuntu package)
ceph-base (Ubuntu package)
ceph-common (Ubuntu package)
librados-devel
ceph-mgr
ceph-resource-agents
ceph-common
rbd-fuse
ceph-fuse
python3-rbd
ceph-base
librgw-devel
ceph-mon
ceph-test
ceph-debugsource
rbd-nbd
cephfs-top
python3-rados
ceph-immutable-object-cache
ceph-osd
ceph-radosgw
libcephsqlite
ceph
ceph-grafana-dashboards
ceph-mgr-rook
ceph-mgr-diskprediction-local
ceph-mgr-modules-core
ceph-mgr-cephadm
libcephfs-devel
ceph-mgr-dashboard
ceph-prometheus-alerts
cephadm
ceph-mgr-k8sevents
librbd1
libradosstriper1
python3-ceph-argparse
ceph-debuginfo
libcephsqlite-devel
ceph-mds
rados-objclass-devel
cephfs-mirror
rbd-mirror
python3-ceph-common
librgw2
librbd-devel
ceph-selinux
libradospp-devel
libcephfs2
python3-cephfs
libradosstriper-devel
python3-rgw
librados2
librgw2-debuginfo
python3-rgw-debuginfo
libcephfs2-debuginfo
ceph-common-debuginfo
librados2-debuginfo
ceph-base-debuginfo
python3-cephfs-debuginfo
python3-rados-debuginfo
python3-rbd-debuginfo
rbd-nbd-debuginfo
librbd1-debuginfo
librados-devel-debuginfo
cephfs-mirror-debuginfo
cephfs-shell
ceph-fuse-debuginfo
rbd-fuse-debuginfo
ceph-radosgw-debuginfo
ceph-mon-debuginfo
libcephsqlite-debuginfo
rbd-mirror-debuginfo
ceph-mds-debuginfo
ceph-immutable-object-cache-debuginfo
ceph-mgr-debuginfo
ceph-osd-debuginfo
ceph-test-debugsource
ceph-test-debuginfo
OpenShift Data Foundation (formerly OpenShift Container Storage)

Install updates from vendor's website.

Ceph - addressed in versions 17.2.2, 16.2.8-84.el9cp
libunwind (Red Hat package) - update to 1.5.0-1.el9cp
leveldb (Red Hat package) - update to 1.23-3.el9cp
oath-toolkit (Red Hat package) - update to 2.6.7-2.el9cp
gperftools (Red Hat package) - update to 2.9.1-2.el9cp
OpenShift Data Foundation (formerly OpenShift Container Storage) - addressed in versions 4.11.0, 4.13.0
ceph (Ubuntu package) - addressed in versions 12.2.13-0ubuntu0.18.04.11, 15.2.17-0ubuntu0.20.04.3, 17.2.5-0ubuntu0.22.04.3, 17.2.5-0ubuntu0.22.10.3
ceph-base (Ubuntu package) - addressed in versions 12.2.13-0ubuntu0.18.04.11, 15.2.17-0ubuntu0.20.04.3, 17.2.5-0ubuntu0.22.04.3, 17.2.5-0ubuntu0.22.10.3
ceph-common (Ubuntu package) - addressed in versions 12.2.13-0ubuntu0.18.04.11, 15.2.17-0ubuntu0.20.04.3, 17.2.5-0ubuntu0.22.04.3, 17.2.5-0ubuntu0.22.10.3
librados-devel - update to 16.2.7-10
ceph-mgr - update to 16.2.7-10
ceph-resource-agents - update to 16.2.7-10
ceph-common - update to 16.2.7-10
rbd-fuse - update to 16.2.7-10
ceph-fuse - update to 16.2.7-10
python3-rbd - update to 16.2.7-10
ceph-base - update to 16.2.7-10
librgw-devel - update to 16.2.7-10
ceph-mon - update to 16.2.7-10
ceph-test - update to 16.2.7-10
ceph-debugsource - update to 16.2.7-10
rbd-nbd - update to 16.2.7-10
cephfs-top - update to 16.2.7-10
python3-rados - update to 16.2.7-10
ceph-immutable-object-cache - update to 16.2.7-10
ceph-osd - update to 16.2.7-10
ceph-radosgw - update to 16.2.7-10
libcephsqlite - update to 16.2.7-10
ceph - update to 16.2.7-10
ceph-grafana-dashboards - update to 16.2.7-10
ceph-mgr-rook - update to 16.2.7-10
ceph-mgr-diskprediction-local - update to 16.2.7-10
ceph-mgr-modules-core - update to 16.2.7-10
ceph-mgr-cephadm - update to 16.2.7-10
libcephfs-devel - update to 16.2.7-10
ceph-mgr-dashboard - update to 16.2.7-10
ceph-prometheus-alerts - update to 16.2.7-10
cephadm - update to 16.2.7-10
ceph-mgr-k8sevents - update to 16.2.7-10
librbd1 - update to 16.2.7-10
libradosstriper1 - update to 16.2.7-10
python3-ceph-argparse - update to 16.2.7-10
ceph-debuginfo - update to 16.2.7-10
libcephsqlite-devel - update to 16.2.7-10
ceph-mds - update to 16.2.7-10
rados-objclass-devel - update to 16.2.7-10
cephfs-mirror - update to 16.2.7-10
rbd-mirror - update to 16.2.7-10
python3-ceph-common - update to 16.2.7-10
librgw2 - update to 16.2.7-10
librbd-devel - update to 16.2.7-10
ceph-selinux - update to 16.2.7-10
libradospp-devel - update to 16.2.7-10
libcephfs2 - update to 16.2.7-10
python3-cephfs - update to 16.2.7-10
libradosstriper-devel - update to 16.2.7-10
python3-rgw - update to 16.2.7-10
librados2 - update to 16.2.7-10
ceph - addressed in versions 16.2.10-1.fc35, 16.2.10-1.fc36
python3-cephfs - addressed in versions 16.2.11.58+g38d6afd3b78-150300.3.6.1, 16.2.11.58+g38d6afd3b78-150300.5.7.1, 16.2.11.58+g38d6afd3b78-150400.3.6.1
cephadm - addressed in versions 16.2.11.58+g38d6afd3b78-150300.3.6.1, 16.2.11.58+g38d6afd3b78-150400.3.6.1
python3-rbd - addressed in versions 16.2.11.58+g38d6afd3b78-150300.3.6.1, 16.2.11.58+g38d6afd3b78-150300.5.7.1, 16.2.11.58+g38d6afd3b78-150400.3.6.1
python3-ceph-common - addressed in versions 16.2.11.58+g38d6afd3b78-150300.3.6.1, 16.2.11.58+g38d6afd3b78-150300.5.7.1, 16.2.11.58+g38d6afd3b78-150400.3.6.1
librgw2-debuginfo - addressed in versions 16.2.11.58+g38d6afd3b78-150300.3.6.1, 16.2.11.58+g38d6afd3b78-150300.5.7.1, 16.2.11.58+g38d6afd3b78-150400.3.6.1
librgw2 - addressed in versions 16.2.11.58+g38d6afd3b78-150300.3.6.1, 16.2.11.58+g38d6afd3b78-150300.5.7.1, 16.2.11.58+g38d6afd3b78-150400.3.6.1
ceph-debugsource - addressed in versions 16.2.11.58+g38d6afd3b78-150300.3.6.1, 16.2.11.58+g38d6afd3b78-150300.5.7.1, 16.2.11.58+g38d6afd3b78-150400.3.6.1
ceph-common - addressed in versions 16.2.11.58+g38d6afd3b78-150300.3.6.1, 16.2.11.58+g38d6afd3b78-150300.5.7.1, 16.2.11.58+g38d6afd3b78-150400.3.6.1
python3-rgw - addressed in versions 16.2.11.58+g38d6afd3b78-150300.3.6.1, 16.2.11.58+g38d6afd3b78-150300.5.7.1, 16.2.11.58+g38d6afd3b78-150400.3.6.1
librbd1 - addressed in versions 16.2.11.58+g38d6afd3b78-150300.3.6.1, 16.2.11.58+g38d6afd3b78-150300.5.7.1, 16.2.11.58+g38d6afd3b78-150400.3.6.1
ceph-base - addressed in versions 16.2.11.58+g38d6afd3b78-150300.3.6.1, 16.2.11.58+g38d6afd3b78-150400.3.6.1
python3-ceph-argparse - addressed in versions 16.2.11.58+g38d6afd3b78-150300.3.6.1, 16.2.11.58+g38d6afd3b78-150300.5.7.1, 16.2.11.58+g38d6afd3b78-150400.3.6.1
python3-rgw-debuginfo - addressed in versions 16.2.11.58+g38d6afd3b78-150300.3.6.1, 16.2.11.58+g38d6afd3b78-150300.5.7.1, 16.2.11.58+g38d6afd3b78-150400.3.6.1
libcephfs2-debuginfo - addressed in versions 16.2.11.58+g38d6afd3b78-150300.3.6.1, 16.2.11.58+g38d6afd3b78-150300.5.7.1, 16.2.11.58+g38d6afd3b78-150400.3.6.1
ceph-common-debuginfo - addressed in versions 16.2.11.58+g38d6afd3b78-150300.3.6.1, 16.2.11.58+g38d6afd3b78-150300.5.7.1, 16.2.11.58+g38d6afd3b78-150400.3.6.1
libcephfs2 - addressed in versions 16.2.11.58+g38d6afd3b78-150300.3.6.1, 16.2.11.58+g38d6afd3b78-150300.5.7.1, 16.2.11.58+g38d6afd3b78-150400.3.6.1
librados2-debuginfo - addressed in versions 16.2.11.58+g38d6afd3b78-150300.3.6.1, 16.2.11.58+g38d6afd3b78-150300.5.7.1, 16.2.11.58+g38d6afd3b78-150400.3.6.1
ceph-base-debuginfo - addressed in versions 16.2.11.58+g38d6afd3b78-150300.3.6.1, 16.2.11.58+g38d6afd3b78-150400.3.6.1
rbd-nbd - addressed in versions 16.2.11.58+g38d6afd3b78-150300.3.6.1, 16.2.11.58+g38d6afd3b78-150300.5.7.1, 16.2.11.58+g38d6afd3b78-150400.3.6.1
python3-cephfs-debuginfo - addressed in versions 16.2.11.58+g38d6afd3b78-150300.3.6.1, 16.2.11.58+g38d6afd3b78-150300.5.7.1, 16.2.11.58+g38d6afd3b78-150400.3.6.1
python3-rados-debuginfo - addressed in versions 16.2.11.58+g38d6afd3b78-150300.3.6.1, 16.2.11.58+g38d6afd3b78-150300.5.7.1, 16.2.11.58+g38d6afd3b78-150400.3.6.1
python3-rbd-debuginfo - addressed in versions 16.2.11.58+g38d6afd3b78-150300.3.6.1, 16.2.11.58+g38d6afd3b78-150300.5.7.1, 16.2.11.58+g38d6afd3b78-150400.3.6.1
rbd-nbd-debuginfo - addressed in versions 16.2.11.58+g38d6afd3b78-150300.3.6.1, 16.2.11.58+g38d6afd3b78-150300.5.7.1, 16.2.11.58+g38d6afd3b78-150400.3.6.1
librbd1-debuginfo - addressed in versions 16.2.11.58+g38d6afd3b78-150300.3.6.1, 16.2.11.58+g38d6afd3b78-150300.5.7.1, 16.2.11.58+g38d6afd3b78-150400.3.6.1
python3-rados - addressed in versions 16.2.11.58+g38d6afd3b78-150300.3.6.1, 16.2.11.58+g38d6afd3b78-150300.5.7.1, 16.2.11.58+g38d6afd3b78-150400.3.6.1
librados2 - addressed in versions 16.2.11.58+g38d6afd3b78-150300.3.6.1, 16.2.11.58+g38d6afd3b78-150300.5.7.1, 16.2.11.58+g38d6afd3b78-150400.3.6.1
libcephfs-devel - addressed in versions 16.2.11.58+g38d6afd3b78-150300.5.7.1, 16.2.11.58+g38d6afd3b78-150400.3.6.1
librados-devel-debuginfo - addressed in versions 16.2.11.58+g38d6afd3b78-150300.5.7.1, 16.2.11.58+g38d6afd3b78-150400.3.6.1
librbd-devel - addressed in versions 16.2.11.58+g38d6afd3b78-150300.5.7.1, 16.2.11.58+g38d6afd3b78-150400.3.6.1
rados-objclass-devel - addressed in versions 16.2.11.58+g38d6afd3b78-150300.5.7.1, 16.2.11.58+g38d6afd3b78-150400.3.6.1
libradospp-devel - addressed in versions 16.2.11.58+g38d6afd3b78-150300.5.7.1, 16.2.11.58+g38d6afd3b78-150400.3.6.1
librgw-devel - addressed in versions 16.2.11.58+g38d6afd3b78-150300.5.7.1, 16.2.11.58+g38d6afd3b78-150400.3.6.1
librados-devel - addressed in versions 16.2.11.58+g38d6afd3b78-150300.5.7.1, 16.2.11.58+g38d6afd3b78-150400.3.6.1
rbd-fuse - update to 16.2.11.58+g38d6afd3b78-150400.3.6.1
cephfs-mirror - update to 16.2.11.58+g38d6afd3b78-150400.3.6.1
cephfs-mirror-debuginfo - update to 16.2.11.58+g38d6afd3b78-150400.3.6.1
cephfs-shell - update to 16.2.11.58+g38d6afd3b78-150400.3.6.1
ceph-fuse - update to 16.2.11.58+g38d6afd3b78-150400.3.6.1
ceph-fuse-debuginfo - update to 16.2.11.58+g38d6afd3b78-150400.3.6.1
rbd-fuse-debuginfo - update to 16.2.11.58+g38d6afd3b78-150400.3.6.1
ceph-mds - update to 16.2.11.58+g38d6afd3b78-150400.3.6.1
ceph - update to 16.2.11.58+g38d6afd3b78-150400.3.6.1
ceph-osd - update to 16.2.11.58+g38d6afd3b78-150400.3.6.1
ceph-prometheus-alerts - update to 16.2.11.58+g38d6afd3b78-150400.3.6.1
ceph-immutable-object-cache - update to 16.2.11.58+g38d6afd3b78-150400.3.6.1
ceph-radosgw - update to 16.2.11.58+g38d6afd3b78-150400.3.6.1
ceph-radosgw-debuginfo - update to 16.2.11.58+g38d6afd3b78-150400.3.6.1
ceph-mon-debuginfo - update to 16.2.11.58+g38d6afd3b78-150400.3.6.1
ceph-mon - update to 16.2.11.58+g38d6afd3b78-150400.3.6.1
ceph-mgr - update to 16.2.11.58+g38d6afd3b78-150400.3.6.1
libcephsqlite - update to 16.2.11.58+g38d6afd3b78-150400.3.6.1
cephfs-top - update to 16.2.11.58+g38d6afd3b78-150400.3.6.1
libcephsqlite-debuginfo - update to 16.2.11.58+g38d6afd3b78-150400.3.6.1
rbd-mirror-debuginfo - update to 16.2.11.58+g38d6afd3b78-150400.3.6.1
libcephsqlite-devel - update to 16.2.11.58+g38d6afd3b78-150400.3.6.1
rbd-mirror - update to 16.2.11.58+g38d6afd3b78-150400.3.6.1
ceph-mds-debuginfo - update to 16.2.11.58+g38d6afd3b78-150400.3.6.1
ceph-immutable-object-cache-debuginfo - update to 16.2.11.58+g38d6afd3b78-150400.3.6.1
ceph-mgr-diskprediction-local - update to 16.2.11.58+g38d6afd3b78-150400.3.6.1
ceph-mgr-debuginfo - update to 16.2.11.58+g38d6afd3b78-150400.3.6.1
ceph-osd-debuginfo - update to 16.2.11.58+g38d6afd3b78-150400.3.6.1
ceph-test-debugsource - update to 16.2.11.58+g38d6afd3b78-150400.3.6.1
ceph-test-debuginfo - update to 16.2.11.58+g38d6afd3b78-150400.3.6.1
ceph-test - update to 16.2.11.58+g38d6afd3b78-150400.3.6.1
ceph-mgr-cephadm - update to 16.2.11.58+g38d6afd3b78-150400.3.6.1
ceph-mgr-rook - update to 16.2.11.58+g38d6afd3b78-150400.3.6.1
ceph-mgr-modules-core - update to 16.2.11.58+g38d6afd3b78-150400.3.6.1
ceph-mgr-k8sevents - update to 16.2.11.58+g38d6afd3b78-150400.3.6.1
ceph-mgr-dashboard - update to 16.2.11.58+g38d6afd3b78-150400.3.6.1
ceph-grafana-dashboards - update to 16.2.11.58+g38d6afd3b78-150400.3.6.1

• https://ceph.io/en/news/blog/2022/v17-2-2-quincy-released/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5O3XMDFZWA2FWU6GAYOVSFJPOUTXN42N/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TIRTTRG5O4YP2TNGDCDOHIHP2DM3DFBT/

• Security restrictions bypass in Ceph
• Multiple vulnerabilities in Red Hat Ceph Storage 5.2
• Red Hat Enterprise Linux 9 update for Ceph
• Multiple vulnerabilities in Red Hat OpenShift Data Foundation
• SUSE update for ceph
• SUSE update for ceph
• SUSE update for ceph
• SUSE update for ceph
• Ubuntu update for ceph
• Multiple vulnerabilities in Red Hat OpenShift Data Foundation 4.13
• openEuler 22.03 LTS update for ceph
• Fedora 36 update for ceph
• Fedora 35 update for ceph