CVE-2022-0670: 
NixOS vulnerability analysis and mitigation

A critical vulnerability (CVE-2022-0670) was discovered in OpenStack Manila's integration with Ceph File system shares. The flaw, which received a CVSS v3.1 base score of 9.1 (Critical), affects systems where OpenStack Manila is used to export native CephFS and were upgraded from Nautilus (or earlier) to a later major version. The vulnerability was fixed in RHCS 5.2 and Ceph 17.2.2 (NVD, Ceph Blog).

The vulnerability exists in the 'volumes' plugin within Ceph Manager, which is responsible for managing Ceph File System subvolumes used by OpenStack Manila services. The flaw enables a share owner to gain unauthorized access to arbitrary portions of the CephFS filesystem hierarchy, instead of being properly restricted to their own subvolumes. This vulnerability specifically impacts OpenStack Manila clusters that provided native CephFS access to their users (Ceph Blog).

The vulnerability allows an attacker to compromise both the confidentiality and integrity of the file system. Specifically, it enables the owner of a Ceph File system share to read and write to any Manila share or the entire file system, significantly breaching the intended access controls (NVD).

The vulnerability has been fixed in RHCS 5.2 and Ceph 17.2.2. Administrators of affected systems should update to these versions or later. Additionally, administrators who are concerned about potential impact should audit their CephX keys in their cluster for proper path restrictions (Ceph Blog).