PT-2022-7554 · Openstack+7 · Openstack Manila+8

Kotresh Hr · Published 2022-07-21 · Updated 2026-03-20 · CVE-2022-0670

Positive Technologies (AI Summary)

CVSS v2.0

9.4

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Openstack manilla versions prior to RHCS 5.2 and Ceph 17.2.2

Description A flaw was found in Openstack manilla owning a Ceph File system "share", which enables the owner to read/write any manilla share or entire file system. The vulnerability is due to a bug in the "volumes" plugin in Ceph Manager. This allows an attacker to compromise Confidentiality and Integrity of a file system.

Recommendations For Openstack manilla versions prior to RHCS 5.2, update to RHCS 5.2 or later to resolve the issue. For Ceph versions prior to 17.2.2, update to Ceph 17.2.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the "volumes" plugin in Ceph Manager to minimize the risk of exploitation.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

ALT-PU-2022-2304

ALT-PU-2022-2350

ALT-PU-2023-1853

ALT-PU-2023-4361

AZL-10387

AZL-38305

BDU:2024-07308

BIT-CEPH-2022-0670

CVE-2022-0670

MGASA-2023-0139

OESA-2022-2125

OPENSUSE-SU-2024:12662-1

RHSA-2022:5997

SUSE-SU-2023:1580-1

SUSE-SU-2023:1581-1

SUSE-SU-2023:1581-2

SUSE-SU-2023:1584-1

SUSE-SU-2023_1580-1

SUSE-SU-2023_1581-1

USN-6063-1

Affected Products

Alt Linux

Astra Linux

Ceph

Debian

Linuxmint

Openstack Manila

Rhcs

Suse

Ubuntu

References · 64

• https://nvd.nist.gov/vuln/detail/CVE-2022-0670 · Security Note
• https://osv.dev/vulnerability/OESA-2022-2125 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-0670 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-10387 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-0670 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TIRTTRG5O4YP2TNGDCDOHIHP2DM3DFBT · Vendor Advisory
• https://ceph.io/en/news/blog/2022/v17-2-2-quincy-released · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-3650 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-0670 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5O3XMDFZWA2FWU6GAYOVSFJPOUTXN42N · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2023-0139 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2022-1110SE17 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-3979 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/5O3XMDFZWA2FWU6GAYOVSFJPOUTXN42N · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-3854 · Vendor Advisory