A privilege escalation flaw was found in Ceph. Ceph-crash.service allows a local attacker to escalate privileges to root in the form of a crash dump, and dump privileged information.

The remote NewStart CGSL host, running version MAIN 7.02, has ceph packages installed that are affected by a vulnerability:

  - A privilege escalation flaw was found in Ceph. Ceph-crash.service allows a local attacker to escalate     privileges to root in the form of a crash dump, and dump privileged information. (CVE-2022-3650)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4310 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4310-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                   Bastien Roucaris     September 25, 2025                            https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : ceph     Version        : 14.2.21-1+deb11u1     CVE ID         : CVE-2021-3979 CVE-2022-3650 CVE-2023-43040 CVE-2025-52555     Debian Bug     : 1024932 1053690 1108410

    Ceph a distributed filesystem was affected by multiple vulnerabilties

    CVE-2021-3979

        A key length flaw was found in Ceph Storage component.
        An attacker can exploit the fact that the key length is incorrectly         passed in an encryption algorithm to create a non random key,         which is weaker and can be exploited for loss of confidentiality         and integrity on encrypted disks.

    CVE-2022-3650

        A privilege escalation flaw was found in Ceph. Ceph-crash.service allows         a local attacker to escalate privileges to root in the form of a crash         dump, and dump privileged information.

    CVE-2023-43040

        A flaw was found in Ceph RGW. An unprivileged         user can write to any bucket(s) accessible by a given key         if a POST's form-data contains a key called 'bucket'         with a value matching the name of the bucket used to sign         the request. The result of this is that a user could actually         upload to any bucket accessible by the specified access key         as long as the bucket in the POST policy matches the bucket         in said POST form part.

    CVE-2025-52555

        An unprivileged user can escalate to root privileges         in a ceph-fuse mounted CephFS by chmod 777 a directory owned         by root to gain access. The result of this is that a user could         read, write and execute to any directory owned by root as long         as they chmod 777 it. This impacts confidentiality,         integrity, and availability.

    For Debian 11 bullseye, these problems have been fixed in version     14.2.21-1+deb11u1.

    We recommend that you upgrade your ceph packages.

    For the detailed security status of ceph please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/ceph

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of ceph installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-3650 advisory.

  - A privilege escalation flaw was found in Ceph. Ceph-crash.service allows a local attacker to escalate     privileges to root in the form of a crash dump, and dump privileged information. (CVE-2022-3650)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of ceph installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-3650 advisory.

  - A privilege escalation flaw was found in Ceph. Ceph-crash.service allows a local attacker to escalate     privileges to root in the form of a crash dump, and dump privileged information. (CVE-2022-3650)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202312-10 (Ceph: Root Privilege Escalation)

  - A privilege escalation flaw was found in Ceph. Ceph-crash.service allows a local attacker to escalate     privileges to root in the form of a crash dump, and dump privileged information. (CVE-2022-3650)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 23.04 host has packages installed that are affected by a vulnerability as referenced in the USN-6292-1 advisory.

    It was discovered that Ceph incorrectly handled crash dumps. A local attacker could possibly use this     issue to escalate privileges to root.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6063-1 advisory.

    Mark Kirkwood discovered that Ceph incorrectly handled certain key lengths. An attacker could possibly use     this issue to create non-random encryption keys. This issue only affected Ubuntu 18.04 LTS and Ubuntu     20.04 LTS. (CVE-2021-3979)

    It was discovered that Ceph incorrectly handled the volumes plugin. An attacker could possibly use this     issue to obtain access to any share. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and     Ubuntu 22.10. (CVE-2022-0670)

    It was discovered that Ceph incorrectly handled crash dumps. A local attacker could possibly use this     issue to escalate privileges to root. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and     Ubuntu 22.10. (CVE-2022-3650)

    It was discovered that Ceph incorrectly handled URL processing on RGW backends. An attacker could possibly     use this issue to cause RGW to crash, leading to a denial of service. This issue only affected Ubuntu     22.04 LTS and Ubuntu 22.10. (CVE-2022-3854)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 36 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-d6b219d19a advisory.

    ceph 16.2.12 GA     Security fix for CVE-2022-3650

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:1581-1 advisory.

    Security issues fixed:

    - CVE-2022-0670: Fixed user/tenant read/write access to an entire file system (bsc#1201837).
    - CVE-2022-3650: Fixed Python script that allowed privilege escalation from ceph to root (bsc#1204430).
    - CVE-2022-3854: Fixed possible DoS issue in ceph URL processing on RGW backends (bsc#1205025).

    Bug fixes:

    - osd, tools, kv: non-aggressive, on-line trimming of accumulated dups (bsc#1199183).
    - ceph-volume: fix fast device alloc size on mulitple device  (bsc#1200262).
    - cephadm: update monitoring container images (bsc#1200501).
    - mgr/dashboard: prevent alert redirect (bsc#1200978).
    - mgr/volumes: Add subvolumegroup resize cmd (bsc#1201797).
    - monitoring/ceph-mixin: add RGW host to label info (bsc#1201976).
    - mgr/dashboard: enable addition of custom Prometheus alerts (bsc#1202077).
    - python-common: Add 'KB' to supported suffixes in SizeMatcher (bsc#1203375).
    - mgr/dashboard: fix rgw connect when using ssl (bsc#1205436).
    - ceph.spec.in: Add -DFMT_DEPRECATED_OSTREAM to CXXFLAGS (bsc#1202292).
    - cephfs-shell: move source to separate subdirectory (bsc#1201604).

    Fix in previous release:

    - mgr/cephadm: try to get FQDN for configuration files (bsc#1196046).
    - When an RBD is mapped, it is attempted to be deployed as an OSD. (bsc#1187748).
    - OSD marked down causes wrong backfill_toofull (bsc#1188911).
    - cephadm: Fix iscsi client caps (allow mgr <service status> calls) (bsc#1192838).
    - mgr/cephadm: fix and improve osd draining (bsc#1200317).
    - add iscsi and nfs to upgrade process (bsc#1206158).
    - mgr/mgr_module.py: CLICommand: Fix parsing of kwargs arguments (bsc#1192840).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:1580-1 advisory.

    Security issues fixed:

    - CVE-2022-0670: Fixed user/tenant read/write access to an entire file system (bsc#1201837).
    - CVE-2022-3650: Fixed Python script that allowed privilege escalation from ceph to root (bsc#1204430).
    - CVE-2022-3854: Fixed possible DoS issue in ceph URL processing on RGW backends (bsc#1205025).

    Bug fixes:

    - osd, tools, kv: non-aggressive, on-line trimming of accumulated dups (bsc#1199183).
    - ceph-volume: fix fast device alloc size on mulitple device  (bsc#1200262).
    - cephadm: update monitoring container images (bsc#1200501).
    - mgr/dashboard: prevent alert redirect (bsc#1200978).
    - mgr/volumes: Add subvolumegroup resize cmd (bsc#1201797).
    - monitoring/ceph-mixin: add RGW host to label info (bsc#1201976).
    - mgr/dashboard: enable addition of custom Prometheus alerts (bsc#1202077).
    - python-common: Add 'KB' to supported suffixes in SizeMatcher (bsc#1203375).
    - mgr/dashboard: fix rgw connect when using ssl (bsc#1205436).
    - ceph.spec.in: Add -DFMT_DEPRECATED_OSTREAM to CXXFLAGS (bsc#1202292).
    - cephfs-shell: move source to separate subdirectory (bsc#1201604).

    Fix in previous release:

    - mgr/cephadm: try to get FQDN for configuration files (bsc#1196046).
    - When an RBD is mapped, it is attempted to be deployed as an OSD. (bsc#1187748).
    - OSD marked down causes wrong backfill_toofull (bsc#1188911).
    - cephadm: Fix iscsi client caps (allow mgr <service status> calls) (bsc#1192838).
    - mgr/cephadm: fix and improve osd draining (bsc#1200317).
    - add iscsi and nfs to upgrade process (bsc#1206158).
    - mgr/mgr_module.py: CLICommand: Fix parsing of kwargs arguments (bsc#1192840).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:0980 advisory.

    Red Hat Ceph Storage is a scalable, open, software-defined storage platform that combines the most stable     version of the Ceph storage system with a Ceph management platform, deployment utilities, and support     services.

    Security Fix(es):

    * Ceph: ceph-crash.service allows local ceph user to root exploit (CVE-2022-3650)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    These updated packages include various bug fixes. Space precludes documenting all of these changes in this     advisory. Users are directed to the Red Hat Ceph Storage Release Notes for information on the most     significant of these changes:

    https://access.redhat.com/documentation/en-us/red_hat_ceph_storage/5.3/html/release_notes/index

    All users of Red Hat Ceph Storage are advised to upgrade to these updated packages that provide various     bugs and security fixes.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
271285	NewStart CGSL MAIN 7.02 : ceph Vulnerability (NS-SA-2025-0247)	Nessus	NewStart CGSL Local Security Checks	Local	high
265944	Debian dla-4310 : ceph - security update	Nessus	Debian Local Security Checks	Local	critical
215717	Azure Linux 3.0 Security Update: ceph (CVE-2022-3650)	Nessus	Azure Linux Local Security Checks	Local	high
201682	CBL Mariner 2.0 Security Update: ceph (CVE-2022-3650)	Nessus	MarinerOS Local Security Checks	Local	high
187284	GLSA-202312-10 : Ceph: Root Privilege Escalation	Nessus	Gentoo Local Security Checks	Local	high
179904	Ubuntu 23.04 : Ceph vulnerability (USN-6292-1)	Nessus	Ubuntu Local Security Checks	Local	high
175537	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : Ceph vulnerabilities (USN-6063-1)	Nessus	Ubuntu Local Security Checks	Local	critical
174654	Fedora 36 : ceph (2023-d6b219d19a)	Nessus	Fedora Local Security Checks	Local	high
173611	SUSE SLED15: ceph / ceph-base / ceph-common / ceph-fuse / etc (SUSE-SU-2023:1581-1)	Nessus	SuSE Local Security Checks	Local	critical
173448	SUSE SLES15: ceph-common / libcephfs-devel / libcephfs2 / librados-devel / etc (SUSE-SU-2023:1580-1)	Nessus	SuSE Local Security Checks	Local	critical
171980	RHEL 8 / 9 : Red Hat Ceph Storage 5.3 Bug fix (RHSA-2023:0980)	Nessus	Red Hat Local Security Checks	Local	high

Detections

Analytics

CVE-2022-3650

high

Tenable Plugins

high

critical

high

high

high

high

critical

high

critical

critical

high