Log in Start free

Vulnerability · Published Oct 29, 2022 · Assigned by mitre

CVE-2022-41973

High 7.8

In plain English

A high-severity security flaw in the device-mapper-multipath package (AlmaLinux). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)7.8High
Exploit odds (30 days)0.7%top 47.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

multipath-tools 0.7.7 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited in conjunction with CVE-2022-41974. Local users able to access /dev/shm can change symlinks in multipathd due to incorrect symlink handling, which could lead to controlled file writes outside of the /dev/shm directory. This could be used indirectly for local privilege escalation to root.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8device-mapper-multipath0.8.4-37.el8ALSA-2023:2948
AlmaLinux:9device-mapper-multipath0.8.7-20.el9ALSA-2023:2459
AlmaLinux:8device-mapper-multipath-devel0.8.4-37.el8ALSA-2023:2948
AlmaLinux:9device-mapper-multipath-devel0.8.7-20.el9ALSA-2023:2459
AlmaLinux:8device-mapper-multipath-libs0.8.4-37.el8ALSA-2023:2948
AlmaLinux:9device-mapper-multipath-libs0.8.7-20.el9ALSA-2023:2459
AlmaLinux:8kpartx0.8.4-37.el8ALSA-2023:2948
AlmaLinux:9kpartx0.8.7-20.el9ALSA-2023:2459
AlmaLinux:8libdmmp0.8.4-37.el8ALSA-2023:2948
Debian:12multipath-tools0.9.4-1DEBIAN-CVE-2022-41973
Debian:13multipath-tools0.9.4-1DEBIAN-CVE-2022-41973
Debian:14multipath-tools0.9.4-1DEBIAN-CVE-2022-41973
Ubuntu:22.04:LTSmultipath-tools0.8.8-1ubuntu1.22.04.1USN-5731-1
Ubuntu:22.04:LTSmultipath-tools0.8.8-1ubuntu1.22.04.1UBUNTU-CVE-2022-41973

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

References