Bug #57967: ceph-crash service should run as unprivileged user, not root (CVE-2022-3650) - Ceph - Ceph

Actions

Copy link

Bug #57967

closed

ceph-crash service should run as unprivileged user, not root (CVE-2022-3650)

Added by Tim Serong over 1 year ago. Updated 9 months ago.

Status:

Resolved

Priority:

Normal

Assignee:

Tim Serong

Category:

Target version:

% Done:

Source:

Tags:

backport_processed

Backport:

quincy,pacific

Regression:

Severity:

3 - minor

Reviewed:

Affected Versions:

ceph-qa-suite:

Pull request ID:

48713

Crash signature (v1):

Crash signature (v2):

Description

As reported at https://www.openwall.com/lists/oss-security/2022/10/25/1, ceph-crash runs as root, which makes it vulnerable to a potential ceph user to root privilege escalation. This is fixable by making the ceph-crash process drop privileges and run as the ceph user, just as the other ceph daemons do.

Related issues 2 (0 open — 2 closed)