CVE-2022-3650 Privilege escalation in Ceph

High 7.8 Published 17 Jan 2023 Updated 3 Nov 2025

A local attacker can escalate privileges to root and dump privileged information via the Ceph-crash service.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2022-3650?

CVE-2022-3650 is a high-severity vulnerability in Ceph, published on 17 Jan 2023. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A privilege escalation flaw was found in Ceph. Ceph-crash.service allows a local attacker to escalate privileges to root in the form of a crash dump, and dump privileged information.

Weakness: CWE-842

Which versions are affected by CVE-2022-3650?

It affects 1 product.

Linux distribution packages (9)

`ceph-mgr` Red Hat:ceph_storage:5.3::el8	All versions	`2:16.2.10-138.el8cp`
`ceph-mgr-cephadm` Red Hat:ceph_storage:5.3::el8	All versions	`2:16.2.10-138.el8cp`
`ceph-mgr-dashboard` Red Hat:ceph_storage:5.3::el8	All versions	`2:16.2.10-138.el8cp`
`ceph-mgr-debuginfo` Red Hat:ceph_storage:5.3::el8	All versions	`2:16.2.10-138.el8cp`
`ceph-mgr-diskprediction-local` Red Hat:ceph_storage:5.3::el8	All versions	`2:16.2.10-138.el8cp`
`ceph-mgr-k8sevents` Red Hat:ceph_storage:5.3::el8	All versions	`2:16.2.10-138.el8cp`
`ceph-mgr-modules-core` Red Hat:ceph_storage:5.3::el8	All versions	`2:16.2.10-138.el8cp`
`ceph-mgr-rook` Red Hat:ceph_storage:5.3::el8	All versions	`2:16.2.10-138.el8cp`
`ceph-mgr-debuginfo` Red Hat:ceph_storage:5.3::el9	All versions	`2:16.2.10-138.el9cp`

Products include Redhat Ceph.

How do I fix CVE-2022-3650?

Apply the vendor's patch.

Is CVE-2022-3650 being exploited?

There is no known exploitation of CVE-2022-3650 in the wild and no public exploit code.

Sources

Also known as AZL-38137, AZL-39295, DEBIAN-CVE-2022-3650, GHSA-4mjm-gg3q-674f, OESA-2022-2156, RHSA-2023:0980 and 1 more.