What’s Vulnerable › Vulnerabilities

CVE-2022-0670

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-07-25 · updated 2026-06-17
• Weakness: CWE-863

Description

A flaw was found in Openstack manilla owning a Ceph File system "share", which enables the owner to read/write any manilla share or entire file system. The vulnerability is due to a bug in the "volumes" plugin in Ceph Manager. This allows an attacker to compromise Confidentiality and Integrity of a file system. Fixed in RHCS 5.2 and Ceph 17.2.2.

Affected products

• Fedoraproject Fedora: 35, 36
• [UNKNOWN] ceph: from 15.0.0 before 15.2.17; from 16.0.0 before 16.2.10; from 17.0.0 before 17.2.2 — fixed in 15.2.17, 16.2.10, 17.2.2
• Red Hat Ceph Storage: before 5.2 — fixed in 5.2

How to fix

Upgrade to a fixed version: [UNKNOWN] ceph 15.2.17, 16.2.10, 17.2.2; Red Hat Ceph Storage 5.2. Check the vendor advisory for mitigations.

References

• https://ceph.io/en/news/blog/2022/v17-2-2-quincy-released/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5O3XMDFZWA2FWU6GAYOVSFJPOUTXN42N/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TIRTTRG5O4YP2TNGDCDOHIHP2DM3DFBT/
• https://ceph.io/en/news/blog/2022/v17-2-2-quincy-released/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5O3XMDFZWA2FWU6GAYOVSFJPOUTXN42N/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TIRTTRG5O4YP2TNGDCDOHIHP2DM3DFBT/

Get alerted when CVE-2022-0670 or the next vulnerability affects your stack