CVE-2025-52555

Publication date 26 June 2025

Last updated 1 August 2025

Ubuntu priority

Medium

Why this priority?

Cvss 3 Severity Score

6.5 · Medium

Score breakdown

Ceph is a distributed object, block, and file storage platform. In versions 17.2.7, 18.2.1 through 18.2.4, and 19.0.0 through 19.2.2, an unprivileged user can escalate to root privileges in a ceph-fuse mounted CephFS by chmod 777 a directory owned by root to gain access. The result of this is that a user could read, write and execute to any directory owned by root as long as they chmod 777 it. This impacts confidentiality, integrity, and availability. It is patched in versions 17.2.8, 18.2.5, and 19.2.3.

Status

Package Ubuntu Release Status
ceph 25.04 plucky
Vulnerable
24.10 oracular Ignored end of life, was needs-triage
24.04 LTS noble
Vulnerable
22.04 LTS jammy
Vulnerable
20.04 LTS focal
Vulnerable
18.04 LTS bionic
Vulnerable
16.04 LTS xenial
Vulnerable
14.04 LTS trusty
Vulnerable

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
ceph

Severity score breakdown

Parameter Value
Base score 6.5 · Medium
Attack vector Adjacent
Attack complexity High
Privileges required Low
User interaction None
Scope Changed
Confidentiality High
Integrity impact Low
Availability impact None
Vector CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N