Vulnerability · Published Jul 25, 2022 · Assigned by redhat
CVE-2022-0670
Critical 9.1
In plain English
A critical-severity incorrect authorization in Ceph. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 70% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)9.1Critical
Exploit odds (30 days)1.3%top 29.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A flaw was found in Openstack manilla owning a Ceph File system "share", which enables the owner to read/write any manilla share or entire file system. The vulnerability is due to a bug in the "volumes" plugin in Ceph Manager. This allows an attacker to compromise Confidentiality and Integrity of a file system. Fixed in RHCS 5.2 and Ceph 17.2.2.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | ceph | 16.2.10+ds-1 | DEBIAN-CVE-2022-0670 |
| Debian:13 | ceph | 16.2.10+ds-1 | DEBIAN-CVE-2022-0670 |
| Debian:14 | ceph | 16.2.10+ds-1 | DEBIAN-CVE-2022-0670 |
| Ubuntu:22.04:LTS | ceph | 17.2.5-0ubuntu0.22.04.3 | USN-6063-1 |
| Ubuntu:22.04:LTS | ceph | 17.2.5-0ubuntu0.22.04.3 | UBUNTU-CVE-2022-0670 |
Affected products (as reported)
Weakness: CWE-863
References
- https://ceph.io/en/news/blog/2022/v17-2-2-quincy-released/ x_refsource_MISC
- FEDORA-2022-67e0522b94 vendor-advisory, x_refsource_FEDORA
- FEDORA-2022-6d129f14f2 vendor-advisory, x_refsource_FEDORA