CVE Feed

    Dashboard / CVE / CVE-2022-3650

    CVE-2022-3650

    A privilege escalation flaw was found in Ceph. Ceph-crash.service allows a local attacker to escalate privileges to root in the form of a crash dump, and dump privileged information.

    Published:Oct 25, 2022
    Last Modified:Nov 3, 2025
    EPS:Jan 17, 2023
    EPSS Score:0.0002
    CVSS Score:7.8

    Affected Products

    Vendor
    Redhat
    Product
    Ceph
    Vendor
    Redhat
    Product
    Ceph Storage

    Exploits

    https://seclists.org/oss-sec/2022/q4/41https://seclists.org/oss-sec/2022/q4/41

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2024-47866 (CVSS 7.5) — Ceph is a distributed object, block, and file storage platform. In versions up to and including 19.2.3, using …
    CVE-2021-3531 (CVSS 5.3) — A flaw was found in the Red Hat Ceph Storage RGW in versions before 14.2.21. When processing a GET Request for…
    CVE-2021-3524 (CVSS 6.5) — A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway) in versions before 14.2.21. The vul…
    CVE-2020-27781 (CVSS 7.1) — User credentials can be manipulated and stolen by Native CephFS consumers of OpenStack Manila, resulting in po…
    CVE-2020-25678 (CVSS 4.4) — A flaw was found in ceph in versions prior to 16.y.z where ceph stores mgr module passwords in clear text. Thi…
    CVE-2020-25660 (CVSS 8.8) — A flaw was found in the Cephx authentication protocol in versions before 15.2.6 and before 14.2.14, where it d…
    CVE-2020-27839 (CVSS 5.4) — A flaw was found in ceph-dashboard. The JSON Web Token (JWT) used for user authentication is stored by the fro…
    CVE-2018-16889 (CVSS 5.5) — Ceph does not properly sanitize encryption keys in debug logging for v4 auth. This results in the leaking of e…
    CVE-2018-16846 (CVSS 6.5) — It was found in Ceph versions before 13.2.4 that authenticated ceph RGW users can cause a denial of service ag…
    CVE-2018-14662 (CVSS 5.7) — It was found Ceph versions before 13.2.4 that authenticated ceph users with read only permissions could steal …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High