Incorrect default permissions in Ceph - CVE-2022-3650

Vulnerability identifier: #VU72630

CSH Severity: Low

CVSS v4: 9.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H]

CVE-ID: CVE-2022-3650

CWE-ID: CWE-276

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to ceph-crash.service runs the ceph-crash Python script with root privileges. The script is operating in the directory /var/lib/ceph/crash which is controlled by the unprivileged ceph user. A local user can inject arbitrary data into the crash dump and force the privileged script to write that file into an arbitrary location on the system, resulting in privilege escalation.

Ceph
Gentoo Linux
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Desktop 15
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
openSUSE Leap Micro
SUSE Enterprise Storage
Red Hat Enterprise Linux for x86_64
Basesystem Module
openSUSE Leap
Ubuntu
openEuler
Fedora
OpenShift Data Foundation (formerly OpenShift Container Storage)
Storage Ceph
cephadm-ansible (Red Hat package)
ceph (Ubuntu package)
ceph-base (Ubuntu package)
ceph-common (Ubuntu package)
ceph-osd
ceph-debuginfo
rbd-nbd
python3-ceph-common
librbd1
libcephsqlite-devel
libcephfs-devel
ceph-mon
rados-objclass-devel
rbd-mirror
libcephfs2
ceph-radosgw
python3-cephfs
cephadm
librgw2
ceph-test
python3-rgw
ceph-mgr
python3-rbd
ceph
ceph-mgr-k8sevents
ceph-mgr-dashboard
cephfs-top
ceph-prometheus-alerts
ceph-grafana-dashboards
libradosstriper-devel
ceph-mgr-rook
ceph-mgr-diskprediction-local
ceph-mgr-cephadm
ceph-mgr-modules-core
ceph-resource-agents
librados2
ceph-base
libradosstriper1
librbd-devel
ceph-immutable-object-cache
ceph-selinux
librgw-devel
cephfs-mirror
libcephsqlite
ceph-common
librados-devel
rbd-fuse
python3-ceph-argparse
ceph-fuse
ceph-mds
python3-rados
libradospp-devel
ceph-debugsource
librgw2-debuginfo
python3-rgw-debuginfo
libcephfs2-debuginfo
ceph-common-debuginfo
librados2-debuginfo
ceph-base-debuginfo
python3-cephfs-debuginfo
python3-rbd-debuginfo
rbd-nbd-debuginfo
librbd1-debuginfo
python3-rados-debuginfo
librados-devel-debuginfo
cephfs-shell
cephfs-mirror-debuginfo
rbd-fuse-debuginfo
ceph-fuse-debuginfo
ceph-radosgw-debuginfo
ceph-mon-debuginfo
libcephsqlite-debuginfo
rbd-mirror-debuginfo
ceph-mds-debuginfo
ceph-immutable-object-cache-debuginfo
ceph-mgr-debuginfo
ceph-osd-debuginfo
ceph-test-debugsource
ceph-test-debuginfo
sys-cluster/ceph

Install updates from vendor's website.

Ceph - addressed in versions 16.2.11, 16.2.10-138.el8cp, 16.2.10-138.el9cp
OpenShift Data Foundation (formerly OpenShift Container Storage) - update to 4.12.1
Storage Ceph - update to 5.3z1
cephadm-ansible (Red Hat package) - update to 1.11.0-1.el8cp
ceph (Ubuntu package) - addressed in versions 12.2.13-0ubuntu0.18.04.11, 15.2.17-0ubuntu0.20.04.3, 17.2.5-0ubuntu0.22.04.3, 17.2.5-0ubuntu0.22.10.3, 17.2.6-0ubuntu0.23.04.2
ceph-base (Ubuntu package) - addressed in versions 12.2.13-0ubuntu0.18.04.11, 15.2.17-0ubuntu0.20.04.3, 17.2.5-0ubuntu0.22.04.3, 17.2.5-0ubuntu0.22.10.3, 17.2.6-0ubuntu0.23.04.2
ceph-common (Ubuntu package) - addressed in versions 12.2.13-0ubuntu0.18.04.11, 15.2.17-0ubuntu0.20.04.3, 17.2.5-0ubuntu0.22.04.3, 17.2.5-0ubuntu0.22.10.3, 17.2.6-0ubuntu0.23.04.2
ceph-osd - update to 16.2.7-11
ceph-debuginfo - update to 16.2.7-11
rbd-nbd - update to 16.2.7-11
python3-ceph-common - update to 16.2.7-11
librbd1 - update to 16.2.7-11
libcephsqlite-devel - update to 16.2.7-11
libcephfs-devel - update to 16.2.7-11
ceph-mon - update to 16.2.7-11
rados-objclass-devel - update to 16.2.7-11
rbd-mirror - update to 16.2.7-11
libcephfs2 - update to 16.2.7-11
ceph-radosgw - update to 16.2.7-11
python3-cephfs - update to 16.2.7-11
cephadm - update to 16.2.7-11
librgw2 - update to 16.2.7-11
ceph-test - update to 16.2.7-11
python3-rgw - update to 16.2.7-11
ceph-mgr - update to 16.2.7-11
python3-rbd - update to 16.2.7-11
ceph - update to 16.2.7-11
ceph-mgr-k8sevents - update to 16.2.7-11
ceph-mgr-dashboard - update to 16.2.7-11
cephfs-top - update to 16.2.7-11
ceph-prometheus-alerts - update to 16.2.7-11
ceph-grafana-dashboards - update to 16.2.7-11
libradosstriper-devel - update to 16.2.7-11
ceph-mgr-rook - update to 16.2.7-11
ceph-mgr-diskprediction-local - update to 16.2.7-11
ceph-mgr-cephadm - update to 16.2.7-11
ceph-mgr-modules-core - update to 16.2.7-11
ceph-resource-agents - update to 16.2.7-11
librados2 - update to 16.2.7-11
ceph-base - update to 16.2.7-11
libradosstriper1 - update to 16.2.7-11
librbd-devel - update to 16.2.7-11
ceph-immutable-object-cache - update to 16.2.7-11
ceph-selinux - update to 16.2.7-11
librgw-devel - update to 16.2.7-11
cephfs-mirror - update to 16.2.7-11
libcephsqlite - update to 16.2.7-11
ceph-common - update to 16.2.7-11
librados-devel - update to 16.2.7-11
rbd-fuse - update to 16.2.7-11
python3-ceph-argparse - update to 16.2.7-11
ceph-fuse - update to 16.2.7-11
ceph-mds - update to 16.2.7-11
python3-rados - update to 16.2.7-11
libradospp-devel - update to 16.2.7-11
ceph-debugsource - update to 16.2.7-11
librgw2-debuginfo - addressed in versions 16.2.11.58+g38d6afd3b78-150300.3.6.1, 16.2.11.58+g38d6afd3b78-150300.5.7.1, 16.2.11.58+g38d6afd3b78-150400.3.6.1
cephadm - addressed in versions 16.2.11.58+g38d6afd3b78-150300.3.6.1, 16.2.11.58+g38d6afd3b78-150400.3.6.1
python3-rbd - addressed in versions 16.2.11.58+g38d6afd3b78-150300.3.6.1, 16.2.11.58+g38d6afd3b78-150300.5.7.1, 16.2.11.58+g38d6afd3b78-150400.3.6.1
python3-ceph-common - addressed in versions 16.2.11.58+g38d6afd3b78-150300.3.6.1, 16.2.11.58+g38d6afd3b78-150300.5.7.1, 16.2.11.58+g38d6afd3b78-150400.3.6.1
librgw2 - addressed in versions 16.2.11.58+g38d6afd3b78-150300.3.6.1, 16.2.11.58+g38d6afd3b78-150300.5.7.1, 16.2.11.58+g38d6afd3b78-150400.3.6.1
ceph-debugsource - addressed in versions 16.2.11.58+g38d6afd3b78-150300.3.6.1, 16.2.11.58+g38d6afd3b78-150300.5.7.1, 16.2.11.58+g38d6afd3b78-150400.3.6.1
ceph-common - addressed in versions 16.2.11.58+g38d6afd3b78-150300.3.6.1, 16.2.11.58+g38d6afd3b78-150300.5.7.1, 16.2.11.58+g38d6afd3b78-150400.3.6.1
python3-rgw - addressed in versions 16.2.11.58+g38d6afd3b78-150300.3.6.1, 16.2.11.58+g38d6afd3b78-150300.5.7.1, 16.2.11.58+g38d6afd3b78-150400.3.6.1
librbd1 - addressed in versions 16.2.11.58+g38d6afd3b78-150300.3.6.1, 16.2.11.58+g38d6afd3b78-150300.5.7.1, 16.2.11.58+g38d6afd3b78-150400.3.6.1
ceph-base - addressed in versions 16.2.11.58+g38d6afd3b78-150300.3.6.1, 16.2.11.58+g38d6afd3b78-150400.3.6.1
python3-ceph-argparse - addressed in versions 16.2.11.58+g38d6afd3b78-150300.3.6.1, 16.2.11.58+g38d6afd3b78-150300.5.7.1, 16.2.11.58+g38d6afd3b78-150400.3.6.1
python3-rgw-debuginfo - addressed in versions 16.2.11.58+g38d6afd3b78-150300.3.6.1, 16.2.11.58+g38d6afd3b78-150300.5.7.1, 16.2.11.58+g38d6afd3b78-150400.3.6.1
libcephfs2-debuginfo - addressed in versions 16.2.11.58+g38d6afd3b78-150300.3.6.1, 16.2.11.58+g38d6afd3b78-150300.5.7.1, 16.2.11.58+g38d6afd3b78-150400.3.6.1
ceph-common-debuginfo - addressed in versions 16.2.11.58+g38d6afd3b78-150300.3.6.1, 16.2.11.58+g38d6afd3b78-150300.5.7.1, 16.2.11.58+g38d6afd3b78-150400.3.6.1
python3-cephfs - addressed in versions 16.2.11.58+g38d6afd3b78-150300.3.6.1, 16.2.11.58+g38d6afd3b78-150300.5.7.1, 16.2.11.58+g38d6afd3b78-150400.3.6.1
librados2-debuginfo - addressed in versions 16.2.11.58+g38d6afd3b78-150300.3.6.1, 16.2.11.58+g38d6afd3b78-150300.5.7.1, 16.2.11.58+g38d6afd3b78-150400.3.6.1
ceph-base-debuginfo - addressed in versions 16.2.11.58+g38d6afd3b78-150300.3.6.1, 16.2.11.58+g38d6afd3b78-150400.3.6.1
libcephfs2 - addressed in versions 16.2.11.58+g38d6afd3b78-150300.3.6.1, 16.2.11.58+g38d6afd3b78-150300.5.7.1, 16.2.11.58+g38d6afd3b78-150400.3.6.1
rbd-nbd - addressed in versions 16.2.11.58+g38d6afd3b78-150300.3.6.1, 16.2.11.58+g38d6afd3b78-150300.5.7.1, 16.2.11.58+g38d6afd3b78-150400.3.6.1
python3-cephfs-debuginfo - addressed in versions 16.2.11.58+g38d6afd3b78-150300.3.6.1, 16.2.11.58+g38d6afd3b78-150300.5.7.1, 16.2.11.58+g38d6afd3b78-150400.3.6.1
python3-rbd-debuginfo - addressed in versions 16.2.11.58+g38d6afd3b78-150300.3.6.1, 16.2.11.58+g38d6afd3b78-150300.5.7.1, 16.2.11.58+g38d6afd3b78-150400.3.6.1
rbd-nbd-debuginfo - addressed in versions 16.2.11.58+g38d6afd3b78-150300.3.6.1, 16.2.11.58+g38d6afd3b78-150300.5.7.1, 16.2.11.58+g38d6afd3b78-150400.3.6.1
librbd1-debuginfo - addressed in versions 16.2.11.58+g38d6afd3b78-150300.3.6.1, 16.2.11.58+g38d6afd3b78-150300.5.7.1, 16.2.11.58+g38d6afd3b78-150400.3.6.1
python3-rados - addressed in versions 16.2.11.58+g38d6afd3b78-150300.3.6.1, 16.2.11.58+g38d6afd3b78-150300.5.7.1, 16.2.11.58+g38d6afd3b78-150400.3.6.1
librados2 - addressed in versions 16.2.11.58+g38d6afd3b78-150300.3.6.1, 16.2.11.58+g38d6afd3b78-150300.5.7.1, 16.2.11.58+g38d6afd3b78-150400.3.6.1
python3-rados-debuginfo - addressed in versions 16.2.11.58+g38d6afd3b78-150300.3.6.1, 16.2.11.58+g38d6afd3b78-150300.5.7.1, 16.2.11.58+g38d6afd3b78-150400.3.6.1
librados-devel-debuginfo - addressed in versions 16.2.11.58+g38d6afd3b78-150300.5.7.1, 16.2.11.58+g38d6afd3b78-150400.3.6.1
libcephfs-devel - addressed in versions 16.2.11.58+g38d6afd3b78-150300.5.7.1, 16.2.11.58+g38d6afd3b78-150400.3.6.1
librbd-devel - addressed in versions 16.2.11.58+g38d6afd3b78-150300.5.7.1, 16.2.11.58+g38d6afd3b78-150400.3.6.1
rados-objclass-devel - addressed in versions 16.2.11.58+g38d6afd3b78-150300.5.7.1, 16.2.11.58+g38d6afd3b78-150400.3.6.1
libradospp-devel - addressed in versions 16.2.11.58+g38d6afd3b78-150300.5.7.1, 16.2.11.58+g38d6afd3b78-150400.3.6.1
librados-devel - addressed in versions 16.2.11.58+g38d6afd3b78-150300.5.7.1, 16.2.11.58+g38d6afd3b78-150400.3.6.1
librgw-devel - addressed in versions 16.2.11.58+g38d6afd3b78-150300.5.7.1, 16.2.11.58+g38d6afd3b78-150400.3.6.1
cephfs-shell - update to 16.2.11.58+g38d6afd3b78-150400.3.6.1
rbd-fuse - update to 16.2.11.58+g38d6afd3b78-150400.3.6.1
cephfs-mirror - update to 16.2.11.58+g38d6afd3b78-150400.3.6.1
cephfs-mirror-debuginfo - update to 16.2.11.58+g38d6afd3b78-150400.3.6.1
rbd-fuse-debuginfo - update to 16.2.11.58+g38d6afd3b78-150400.3.6.1
ceph-mds - update to 16.2.11.58+g38d6afd3b78-150400.3.6.1
ceph - update to 16.2.11.58+g38d6afd3b78-150400.3.6.1
ceph-osd - update to 16.2.11.58+g38d6afd3b78-150400.3.6.1
ceph-fuse-debuginfo - update to 16.2.11.58+g38d6afd3b78-150400.3.6.1
ceph-fuse - update to 16.2.11.58+g38d6afd3b78-150400.3.6.1
cephfs-top - update to 16.2.11.58+g38d6afd3b78-150400.3.6.1
ceph-prometheus-alerts - update to 16.2.11.58+g38d6afd3b78-150400.3.6.1
ceph-immutable-object-cache - update to 16.2.11.58+g38d6afd3b78-150400.3.6.1
ceph-radosgw - update to 16.2.11.58+g38d6afd3b78-150400.3.6.1
ceph-radosgw-debuginfo - update to 16.2.11.58+g38d6afd3b78-150400.3.6.1
ceph-mon-debuginfo - update to 16.2.11.58+g38d6afd3b78-150400.3.6.1
ceph-mon - update to 16.2.11.58+g38d6afd3b78-150400.3.6.1
ceph-mgr - update to 16.2.11.58+g38d6afd3b78-150400.3.6.1
libcephsqlite - update to 16.2.11.58+g38d6afd3b78-150400.3.6.1
ceph-mgr-diskprediction-local - update to 16.2.11.58+g38d6afd3b78-150400.3.6.1
libcephsqlite-debuginfo - update to 16.2.11.58+g38d6afd3b78-150400.3.6.1
rbd-mirror-debuginfo - update to 16.2.11.58+g38d6afd3b78-150400.3.6.1
libcephsqlite-devel - update to 16.2.11.58+g38d6afd3b78-150400.3.6.1
rbd-mirror - update to 16.2.11.58+g38d6afd3b78-150400.3.6.1
ceph-mds-debuginfo - update to 16.2.11.58+g38d6afd3b78-150400.3.6.1
ceph-immutable-object-cache-debuginfo - update to 16.2.11.58+g38d6afd3b78-150400.3.6.1
ceph-grafana-dashboards - update to 16.2.11.58+g38d6afd3b78-150400.3.6.1
ceph-mgr-debuginfo - update to 16.2.11.58+g38d6afd3b78-150400.3.6.1
ceph-osd-debuginfo - update to 16.2.11.58+g38d6afd3b78-150400.3.6.1
ceph-test-debugsource - update to 16.2.11.58+g38d6afd3b78-150400.3.6.1
ceph-test - update to 16.2.11.58+g38d6afd3b78-150400.3.6.1
ceph-mgr-cephadm - update to 16.2.11.58+g38d6afd3b78-150400.3.6.1
ceph-mgr-rook - update to 16.2.11.58+g38d6afd3b78-150400.3.6.1
ceph-mgr-modules-core - update to 16.2.11.58+g38d6afd3b78-150400.3.6.1
ceph-test-debuginfo - update to 16.2.11.58+g38d6afd3b78-150400.3.6.1
ceph-mgr-k8sevents - update to 16.2.11.58+g38d6afd3b78-150400.3.6.1
ceph-mgr-dashboard - update to 16.2.11.58+g38d6afd3b78-150400.3.6.1
ceph - update to 16.2.12-1.fc36
sys-cluster/ceph - update to 17.2.6

• https://bugzilla.redhat.com/show_bug.cgi?id=2136909

• Multiple vulnerabilities in Ceph
• Privilege escalation in Red Hat Ceph Storage
• Multiple vulnerabilities in Red Hat OpenShift Data Foundation 4.12
• SUSE update for ceph
• SUSE update for ceph
• SUSE update for ceph
• SUSE update for ceph
• Ubuntu update for ceph
• Ubuntu update for ceph
• Fedora 36 update for ceph
• Gentoo update for Ceph
• openEuler 22.03 LTS update for ceph
• IBM Storage Ceph update for Ceph