Bug #57967: ceph-crash service should run as unprivileged user, not root (CVE-2022-3650) - Ceph - Ceph

Actions

Copy link

Bug #57967

closed

ceph-crash service should run as unprivileged user, not root (CVE-2022-3650)

Added by Tim Serong over 3 years ago. Updated 8 months ago.

Status:

Resolved

Priority:

Normal

Assignee:

Tim Serong

Category:

Target version:

% Done:

Source:

Backport:

quincy,pacific

Regression:

Severity:

3 - minor

Reviewed:

Affected Versions:

ceph-qa-suite:

Pull request ID:

48713

Crash signature (v1):

Crash signature (v2):

Tags (freeform):

Merge Commit:

2b62b893b2a5e7b434dc70acc106b4ba18b554cf

Fixed In:

v18.0.0-778-g2b62b893b2a

Released In:

v18.2.0~1066

Upkeep Timestamp:

2025-07-12T22:08:57+00:00

Description

As reported at https://www.openwall.com/lists/oss-security/2022/10/25/1, ceph-crash runs as root, which makes it vulnerable to a potential ceph user to root privilege escalation. This is fixable by making the ceph-crash process drop privileges and run as the ceph user, just as the other ceph daemons do.

Related issues 2 (0 open — 2 closed)