SUSE update for ceph



Risk Medium
Patch available YES
Number of vulnerabilities 3
CVE-ID CVE-2022-0670
CVE-2022-3650
CVE-2022-3854
CWE-ID CWE-264
CWE-276
CWE-20
Exploitation vector Network
Public exploit N/A
Vulnerable software
 SUSE Linux Enterprise Micro for Rancher
Operating systems & Components / Operating system

SUSE Linux Enterprise Micro
Operating systems & Components / Operating system

librbd1-debuginfo
Operating systems & Components / Operating system package or component

ceph-debugsource
Operating systems & Components / Operating system package or component

librados2-debuginfo
Operating systems & Components / Operating system package or component

librbd1
Operating systems & Components / Operating system package or component

librados2
Operating systems & Components / Operating system package or component

Vendor SUSE

Security Bulletin

This security bulletin contains information about 3 vulnerabilities.

1) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU66440

Risk: Medium

CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2022-0670

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote user to escalate privileges on the system.

The vulnerability exists due to an error within the "volumes" plugin in Ceph Manager. The Openstack manilla owning a Ceph File system "share" enables the owner to read/write any manilla share or entire file system.

Mitigation

Update the affected package ceph to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Micro for Rancher: 5.4

SUSE Linux Enterprise Micro: 5.4

librbd1-debuginfo: before 16.2.11.58+g38d6afd3b78-150400.3.6.1

ceph-debugsource: before 16.2.11.58+g38d6afd3b78-150400.3.6.1

librados2-debuginfo: before 16.2.11.58+g38d6afd3b78-150400.3.6.1

librbd1: before 16.2.11.58+g38d6afd3b78-150400.3.6.1

librados2: before 16.2.11.58+g38d6afd3b78-150400.3.6.1

CPE2.3 External links

https://www.suse.com/support/update/announcement/2023/suse-su-20231581-2/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Incorrect default permissions

EUVDB-ID: #VU72630

Risk: Low

CVSSv4.0: 7.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/U:Clear]

CVE-ID: CVE-2022-3650

CWE-ID: CWE-276 - Incorrect Default Permissions

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to ceph-crash.service runs the ceph-crash Python script with root privileges. The script is operating in the directory /var/lib/ceph/crash which is controlled by the unprivileged ceph user. A local user can inject arbitrary data into the crash dump and force the privileged script to write that file into an arbitrary location on the system, resulting in privilege escalation.

Mitigation

Update the affected package ceph to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Micro for Rancher: 5.4

SUSE Linux Enterprise Micro: 5.4

librbd1-debuginfo: before 16.2.11.58+g38d6afd3b78-150400.3.6.1

ceph-debugsource: before 16.2.11.58+g38d6afd3b78-150400.3.6.1

librados2-debuginfo: before 16.2.11.58+g38d6afd3b78-150400.3.6.1

librbd1: before 16.2.11.58+g38d6afd3b78-150400.3.6.1

librados2: before 16.2.11.58+g38d6afd3b78-150400.3.6.1

CPE2.3 External links

https://www.suse.com/support/update/announcement/2023/suse-su-20231581-2/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Input validation error

EUVDB-ID: #VU74055

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2022-3854

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input when handling URL on RGW backends. A remote attacker can pass specially crafted URL to the application and perform a denial of service (DoS) attack.

Mitigation

Update the affected package ceph to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Micro for Rancher: 5.4

SUSE Linux Enterprise Micro: 5.4

librbd1-debuginfo: before 16.2.11.58+g38d6afd3b78-150400.3.6.1

ceph-debugsource: before 16.2.11.58+g38d6afd3b78-150400.3.6.1

librados2-debuginfo: before 16.2.11.58+g38d6afd3b78-150400.3.6.1

librbd1: before 16.2.11.58+g38d6afd3b78-150400.3.6.1

librados2: before 16.2.11.58+g38d6afd3b78-150400.3.6.1

CPE2.3 External links

https://www.suse.com/support/update/announcement/2023/suse-su-20231581-2/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###