CVE-2022-0670: Critical severity ceph vulnerability
A flaw was found in Openstack manilla owning a Ceph File system "share", which enables the owner to read/write any manilla share or entire file system. The vulnerability is due to a bug in the "volumes" plugin in Ceph Manager. This allows an attacker to compromise Confidentiality and Integrity of a file system. Fixed in RHCS 5.2 and Ceph 17.2.2.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-0670?
CVE-2022-0670 is a vulnerability found in Openstack manilla owning a Ceph File system share which enables the owner to read/write any manilla share or entire file system.
How does CVE-2022-0670 impact the system?
CVE-2022-0670 allows an attacker to compromise the confidentiality and integrity of a system by exploiting a bug in the 'volumes' plugin in Ceph Manager.
Which software is affected by CVE-2022-0670?
The following versions of the 'ceph' package on Ubuntu and Debian are affected: 15.2.17, 16.2.10, 17.2.2, 17.2.5-0ubuntu0.22.10.3, 15.2.17-0ubuntu0.20.04.3, 17.2.5-0ubuntu0.22.04.3, 12.2.11+dfsg1-2.1, 16.2.11+ds-2, 16.2.11+ds-3.
How can I fix CVE-2022-0670 on Ubuntu?
To fix CVE-2022-0670 on Ubuntu, update the 'ceph' package to one of the following versions: 17.2.5-0ubuntu0.22.10.3, 15.2.17-0ubuntu0.20.04.3, 17.2.5-0ubuntu0.22.04.3.
How can I fix CVE-2022-0670 on Debian?
To fix CVE-2022-0670 on Debian, update the 'ceph' package to version 14.2.21-1 or higher.