CVE-2022-3650

Aliases:DEBIAN-CVE-2022-3650RHSA-2023:0980
Advisory lineage Upstream: 0 Downstream: 10
Modified
Published: 17 Jan 2023, 00:00
Last modified:03 Nov 2025, 18:08

Vulnerability Summary

Overall Risk (default)
medium
41/100
CVSS Score
7.8 HIGH
v3.1 (nvd)
EPSS Score
0.33% LOW
0% probability +0.30%
KEV
Not listed
Ransomware
No reports
Public exploits
1 found
Dark Web
Not detected

Timeline

17 Jan 2023, 00:00
Published
Vulnerability first disclosed
03 Nov 2025, 18:08
Last Modified
Vulnerability information updated

Description

A privilege escalation flaw was found in Ceph. Ceph-crash.service allows a local attacker to escalate privileges to root in the form of a crash dump, and dump privileged information.

CVSS Metrics

  • v3.1•HIGH•Score: 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • v3.1•HIGH•Score: 8.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

EPSS Trends

Current EPSS score: 0.33%• Percentile: 26%

Techniques & Countermeasures

  • CWE-842•Placement of User into Incorrect Group

    The product or the administrator places a user into an incorrect group.

Affected Systems

  • debian•ceph

    < 14.2.21-1+deb11u1 | < 16.2.10+ds-4 | < 16.2.10+ds-4 | < 16.2.10+ds-4

  • redhat•ceph

    16.2.9

  • redhat•ceph-mgr

    < 2:16.2.10-138.el8cp

  • redhat•ceph-mgr-cephadm

    < 2:16.2.10-138.el8cp

  • redhat•ceph-mgr-dashboard

    < 2:16.2.10-138.el8cp

  • redhat•ceph-mgr-debuginfo

    < 2:16.2.10-138.el8cp | < 2:16.2.10-138.el9cp

  • redhat•ceph-mgr-diskprediction-local

    < 2:16.2.10-138.el8cp

  • redhat•ceph-mgr-k8sevents

    < 2:16.2.10-138.el8cp

  • redhat•ceph-mgr-modules-core

    < 2:16.2.10-138.el8cp

  • redhat•ceph-mgr-rook

    < 2:16.2.10-138.el8cp

References (68)