Vulnerability · Published Mar 29, 2023 · Assigned by redhat
CVE-2022-3787
High 7.8
In plain English
A high-severity security flaw in device-mapper-multipath. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A vulnerability was found in the device-mapper-multipath. The device-mapper-multipath allows local users to obtain root access, exploited alone or in conjunction with CVE-2022-41973. Local users that are able to write to UNIX domain sockets can bypass access controls and manipulate the multipath setup. This issue occurs because an attacker can repeat a keyword, which is mishandled when arithmetic ADD is used instead of bitwise OR. This could lead to local privilege escalation to root.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | device-mapper-multipath | 0.8.4-28.el8_7.1 | ALSA-2022:7928 |
| AlmaLinux:9 | device-mapper-multipath | 0.8.7-12.el9_1.1 | ALSA-2022:8453 |
| Rocky Linux:8 | device-mapper-multipath | 0:0.8.4-28.el8_7.1 | RLSA-2022:7928 |
| Rocky Linux:9 | device-mapper-multipath | 0:0.8.7-12.el9_1.1 | RLSA-2022:8453 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | device-mapper-multipath | unknown |
Weakness: CWE-285 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H