CVE-2022-3854

What it actually does

A null URL supplied to RGW URL processing causes the backend process to crash, producing a denial of service.

Why it matters to the business

Interrupts object-storage availability for any Ceph RGW deployments, potentially causing application outages; no ransomware campaigns or CISA deadlines apply, and the flaw affects a moderate number of Ubuntu freetype packages.

How an attack unfolds

An unauthenticated remote attacker crafts an HTTP request containing a null URL and sends it to an exposed RGW endpoint; the malformed input triggers an unhandled condition that terminates the RGW daemon.

How to fix it

Upgrade affected freetype packages on Ubuntu 20.04 LTS to 2.10.1-2ubuntu0.3 and on Ubuntu 22.04 LTS to 2.11.1+dfsg-1ubuntu0.2; apply the corresponding Ceph RGW patches once released.

How to confirm the fix worked

Confirm package versions match the listed fixed releases and test that RGW remains stable when receiving null-URL requests.

Typical attack path

1. Locate an internet-facing Ceph RGW endpoint
2. Craft an HTTP request containing a null URL value
3. Send the request to trigger process termination

How to detect it

Review RGW access logs for requests that produce sudden daemon restarts or segmentation faults; correlate with null or empty URL fields in incoming requests.

What your security team should do

• Apply the listed freetype updates immediately on all Ubuntu 20.04 and 22.04 systems
• Restrict direct internet exposure of RGW endpoints until patched
• Monitor Ceph release notes for official RGW fixes