Security Bulletin: IBM Storage Ceph is vulnerable to Placement of User into Incorrect Group in Ceph-crash.service (CVE-2022-3650)

Summary Ceph-crash.service is used by IBM Storage Ceph. CVE-2022-3650 This bulletin identifies the steps to take to address the vulnerability in Ceph. Vulnerability Details CVEID:CVE-2022-3650 DESCRIPTION: Ceph could allow a local authenticated attacker to gain elevated privileges on the system,...

CVE-2022-3650

CVE-2022-3650 is a local privilege-escalation flaw in Ceph via the ceph-crash.service, allowing an authenticated local attacker to gain root privileges (via crash dump contents). Affected is Ceph prior to patched versions; the root cause is the ceph-crash script running as root in /var/lib/ceph/c...

CVE-2022-3650

A privilege escalation flaw was found in Ceph. Ceph-crash.service allows a local attacker to escalate privileges to root in the form of a crash dump, and dump privileged information. This issue can lead to loss of confidentiality, integrity, and availability...