A flaw was found in Openstack manilla owning a Ceph File system "share", which enables the owner to read/write any manilla share or entire file system. The vulnerability is due to a bug in the "volumes" plugin in Ceph Manager. This allows an attacker to compromise Confidentiality and Integrity of a file system. Fixed in RHCS 5.2 and Ceph 17.2.2.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4460 advisory.

    - -----------------------------------------------------------------------     Debian LTS Advisory DLA-4460-1              debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Utkarsh Gupta     February 01, 2026                           https://wiki.debian.org/LTS
    - -----------------------------------------------------------------------

    Package        : ceph     Version        : 14.2.21-1+deb11u2     CVE ID         : CVE-2022-0670 CVE-2024-47866     Debian Bug     : 1016069 1120797

    Ceph is a distributed object, block, and file storage platform.

    CVE-2022-0670

        A flaw was found in Openstack manilla owning a Ceph File system         share, which enables the owner to read/write any manilla share         or entire file system. The vulnerability is due to a bug in the         volumes plugin in Ceph Manager. This allows an attacker to         compromise confidentiality and integrity of a file system.

    CVE-2024-47866

        Using the argument `x-amz-copy-source` to put an object and         specifying an empty string as its content leads to the RGW daemon         crashing, resulting in a DoS attack.

    For Debian 11 bullseye, these problems have been fixed in version     14.2.21-1+deb11u2.

    We recommend that you upgrade your ceph packages.

    For the detailed security status of ceph please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/ceph

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of ceph installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-0670 advisory.

  - A flaw was found in Openstack manilla owning a Ceph File system share, which enables the owner to     read/write any manilla share or entire file system. The vulnerability is due to a bug in the volumes     plugin in Ceph Manager. This allows an attacker to compromise Confidentiality and Integrity of a file     system. Fixed in RHCS 5.2 and Ceph 17.2.2. (CVE-2022-0670)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A flaw was found in Openstack manilla owning a Ceph File system "share", which enables the owner to
    read/write any manilla share or entire file system. The vulnerability is due to a bug in the "volumes"
    plugin in Ceph Manager. This allows an attacker to compromise Confidentiality and Integrity of a file
    system. Fixed in RHCS 5.2 and Ceph 17.2.2. (CVE-2022-0670)

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6063-1 advisory.

    Mark Kirkwood discovered that Ceph incorrectly handled certain key lengths. An attacker could possibly use     this issue to create non-random encryption keys. This issue only affected Ubuntu 18.04 LTS and Ubuntu     20.04 LTS. (CVE-2021-3979)

    It was discovered that Ceph incorrectly handled the volumes plugin. An attacker could possibly use this     issue to obtain access to any share. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and     Ubuntu 22.10. (CVE-2022-0670)

    It was discovered that Ceph incorrectly handled crash dumps. A local attacker could possibly use this     issue to escalate privileges to root. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and     Ubuntu 22.10. (CVE-2022-3650)

    It was discovered that Ceph incorrectly handled URL processing on RGW backends. An attacker could possibly     use this issue to cause RGW to crash, leading to a denial of service. This issue only affected Ubuntu     22.04 LTS and Ubuntu 22.10. (CVE-2022-3854)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:1581-1 advisory.

    Security issues fixed:

    - CVE-2022-0670: Fixed user/tenant read/write access to an entire file system (bsc#1201837).
    - CVE-2022-3650: Fixed Python script that allowed privilege escalation from ceph to root (bsc#1204430).
    - CVE-2022-3854: Fixed possible DoS issue in ceph URL processing on RGW backends (bsc#1205025).

    Bug fixes:

    - osd, tools, kv: non-aggressive, on-line trimming of accumulated dups (bsc#1199183).
    - ceph-volume: fix fast device alloc size on mulitple device  (bsc#1200262).
    - cephadm: update monitoring container images (bsc#1200501).
    - mgr/dashboard: prevent alert redirect (bsc#1200978).
    - mgr/volumes: Add subvolumegroup resize cmd (bsc#1201797).
    - monitoring/ceph-mixin: add RGW host to label info (bsc#1201976).
    - mgr/dashboard: enable addition of custom Prometheus alerts (bsc#1202077).
    - python-common: Add 'KB' to supported suffixes in SizeMatcher (bsc#1203375).
    - mgr/dashboard: fix rgw connect when using ssl (bsc#1205436).
    - ceph.spec.in: Add -DFMT_DEPRECATED_OSTREAM to CXXFLAGS (bsc#1202292).
    - cephfs-shell: move source to separate subdirectory (bsc#1201604).

    Fix in previous release:

    - mgr/cephadm: try to get FQDN for configuration files (bsc#1196046).
    - When an RBD is mapped, it is attempted to be deployed as an OSD. (bsc#1187748).
    - OSD marked down causes wrong backfill_toofull (bsc#1188911).
    - cephadm: Fix iscsi client caps (allow mgr <service status> calls) (bsc#1192838).
    - mgr/cephadm: fix and improve osd draining (bsc#1200317).
    - add iscsi and nfs to upgrade process (bsc#1206158).
    - mgr/mgr_module.py: CLICommand: Fix parsing of kwargs arguments (bsc#1192840).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:1580-1 advisory.

    Security issues fixed:

    - CVE-2022-0670: Fixed user/tenant read/write access to an entire file system (bsc#1201837).
    - CVE-2022-3650: Fixed Python script that allowed privilege escalation from ceph to root (bsc#1204430).
    - CVE-2022-3854: Fixed possible DoS issue in ceph URL processing on RGW backends (bsc#1205025).

    Bug fixes:

    - osd, tools, kv: non-aggressive, on-line trimming of accumulated dups (bsc#1199183).
    - ceph-volume: fix fast device alloc size on mulitple device  (bsc#1200262).
    - cephadm: update monitoring container images (bsc#1200501).
    - mgr/dashboard: prevent alert redirect (bsc#1200978).
    - mgr/volumes: Add subvolumegroup resize cmd (bsc#1201797).
    - monitoring/ceph-mixin: add RGW host to label info (bsc#1201976).
    - mgr/dashboard: enable addition of custom Prometheus alerts (bsc#1202077).
    - python-common: Add 'KB' to supported suffixes in SizeMatcher (bsc#1203375).
    - mgr/dashboard: fix rgw connect when using ssl (bsc#1205436).
    - ceph.spec.in: Add -DFMT_DEPRECATED_OSTREAM to CXXFLAGS (bsc#1202292).
    - cephfs-shell: move source to separate subdirectory (bsc#1201604).

    Fix in previous release:

    - mgr/cephadm: try to get FQDN for configuration files (bsc#1196046).
    - When an RBD is mapped, it is attempted to be deployed as an OSD. (bsc#1187748).
    - OSD marked down causes wrong backfill_toofull (bsc#1188911).
    - cephadm: Fix iscsi client caps (allow mgr <service status> calls) (bsc#1192838).
    - mgr/cephadm: fix and improve osd draining (bsc#1200317).
    - add iscsi and nfs to upgrade process (bsc#1206158).
    - mgr/mgr_module.py: CLICommand: Fix parsing of kwargs arguments (bsc#1192840).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:5997 advisory.

    Red Hat Ceph Storage is a scalable, open, software-defined storage platform that combines the most stable     version of the Ceph storage system with a Ceph management platform, deployment utilities, and support     services.

    The ceph-ansible package provides Ansible playbooks for installing, maintaining, and upgrading Red Hat     Ceph Storage.

    Perf Tools is a collection of performance analysis tools, including a high-performance multi-threaded     malloc() implementation that works particularly well with threads and STL, a thread-friendly heap-checker,     a heap profiler, and a cpu-profiler.

    The libunwind packages contain a C API to determine the call chain of a program. This API is necessary for     compatibility with Google Performance Tools (gperftools).

    nfs-ganesha : NFS-GANESHA is a NFS Server running in user space. It comes with various back-end modules     (called FSALs) provided as shared objects to support different file systems and name-spaces.

    The following packages have been upgraded to a later upstream version: ceph (16.2.8), ceph-ansible     (6.0.27.9), cephadm-ansible (1.8.0), gperftools (2.9.1), leveldb (1.23), libunwind (1.5.0), nfs-ganesha     (3.5), oath-toolkit (2.6.7). (BZ#1623330, BZ#1942171, BZ#1977888, BZ#1997480, BZ#1997996, BZ#2006214,     BZ#2006771, BZ#2013215, BZ#2018906, BZ#2024720, BZ#2028628, BZ#2029307, BZ#2030540, BZ#2039669,     BZ#2041563, BZ#2041571, BZ#2042417, BZ#2042602, BZ#2043602, BZ#2047487, BZ#2048681, BZ#2049272,     BZ#2053468, BZ#2053591, BZ#2055173, BZ#2057307, BZ#2060278, BZ#2064627, BZ#2077843, BZ#2080242)

    Security Fix(es):

    * ceph: user/tenant can obtain access (read/write) to any share (CVE-2022-0670)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    This update also fixes several bugs and adds various enhancements. Documentation for these changes is     available from the Release Notes document linked to in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
297490	Debian dla-4460 : ceph - security update	Nessus	Debian Local Security Checks	critical
201806	CBL Mariner 2.0 Security Update: ceph (CVE-2022-0670)	Nessus	MarinerOS Local Security Checks	critical
403794	Alpine: ceph16: security update to 16.2.10-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
403794	Alpine: ceph16: security update to 16.2.10-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
403784	Alpine: ceph: security update to 15.2.17-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
403784	Alpine: ceph: security update to 15.2.17-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
175537	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : Ceph vulnerabilities (USN-6063-1)	Nessus	Ubuntu Local Security Checks	critical
173611	SUSE SLED15: ceph / ceph-base / ceph-common / ceph-fuse / etc (SUSE-SU-2023:1581-1)	Nessus	SuSE Local Security Checks	critical
173448	SUSE SLES15: ceph-common / libcephfs-devel / libcephfs2 / librados-devel / etc (SUSE-SU-2023:1580-1)	Nessus	SuSE Local Security Checks	critical
163972	RHEL 8 / 9 : Red Hat Ceph Storage Security, Bug Fix, and Enhancement Update (Moderate) (RHSA-2022:5997)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2022-0670

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical