Vulnerability · Published Oct 29, 2022 · Assigned by mitre
CVE-2022-41974
High 7.8
In plain English
A high-severity security flaw in the device-mapper-multipath package (AlmaLinux). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
multipath-tools 0.7.0 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited alone or in conjunction with CVE-2022-41973. Local users able to write to UNIX domain sockets can bypass access controls and manipulate the multipath setup. This can lead to local privilege escalation to root. This occurs because an attacker can repeat a keyword, which is mishandled because arithmetic ADD is used instead of bitwise OR.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | device-mapper-multipath | 0.8.4-22.el8_6.2 | ALSA-2022:7192 |
| AlmaLinux:8 | device-mapper-multipath | 0.8.4-28.el8_7.1 | ALSA-2022:7928 |
| AlmaLinux:9 | device-mapper-multipath | 0.8.7-7.el9_0.1 | ALSA-2022:7185 |
| AlmaLinux:9 | device-mapper-multipath | 0.8.7-12.el9_1.1 | ALSA-2022:8453 |
| AlmaLinux:8 | device-mapper-multipath-devel | 0.8.4-22.el8_6.2 | ALSA-2022:7192 |
| AlmaLinux:9 | device-mapper-multipath-devel | 0.8.7-7.el9_0.1 | ALSA-2022:7185 |
| AlmaLinux:8 | device-mapper-multipath-libs | 0.8.4-22.el8_6.2 | ALSA-2022:7192 |
| AlmaLinux:9 | device-mapper-multipath-libs | 0.8.7-7.el9_0.1 | ALSA-2022:7185 |
| AlmaLinux:8 | kpartx | 0.8.4-22.el8_6.2 | ALSA-2022:7192 |
| AlmaLinux:9 | kpartx | 0.8.7-7.el9_0.1 | ALSA-2022:7185 |
| AlmaLinux:8 | libdmmp | 0.8.4-22.el8_6.2 | ALSA-2022:7192 |
| Debian:12 | multipath-tools | 0.9.4-1 | DEBIAN-CVE-2022-41974 |
| Debian:13 | multipath-tools | 0.9.4-1 | DEBIAN-CVE-2022-41974 |
| Debian:14 | multipath-tools | 0.9.4-1 | DEBIAN-CVE-2022-41974 |
| Rocky Linux:8 | device-mapper-multipath | 0:0.8.4-22.el8_6.2 | RLSA-2022:7192 |
| Rocky Linux:9 | device-mapper-multipath | 0:0.8.7-7.el9_0.1 | RLSA-2022:7185 |
| Ubuntu:22.04:LTS | multipath-tools | 0.8.8-1ubuntu1.22.04.1 | UBUNTU-CVE-2022-41974 |
| Ubuntu:22.04:LTS | multipath-tools | 0.8.8-1ubuntu1.22.04.1 | USN-5731-1 |
Affected products (as reported)
References
- https://bugzilla.suse.com/show_bug.cgi?id=1202739
- https://github.com/opensvc/multipath-tools/releases/tag/0.9.2
- http://www.openwall.com/lists/oss-security/2022/10/24/2
- 20221030 Authorization bypass and symlink attack in multipathd (CVE-2022-41974 and CVE-2022-41973) mailing-list
- http://packetstormsecurity.com/files/169611/Leeloo-Multipath-Authorization-Bypass-Symlink-Attack.html
- FEDORA-2022-6ec78b2586 vendor-advisory
- https://www.qualys.com/2022/10/24/leeloo-multipath/leeloo-multipath.txt
- [oss-security] 20221130 Race condition in snap-confine's must_mkdir_and_open_with_perms() (CVE-2022-3328) mailing-list
- 20221208 Race condition in snap-confine's must_mkdir_and_open_with_perms() (CVE-2022-3328) mailing-list
- http://packetstormsecurity.com/files/170176/snap-confine-must_mkdir_and_open_with_perms-Race-Condition.html
- [debian-lts-announce] 20221229 [SECURITY] [DLA 3250-1] multipath-tools security update mailing-list
- DSA-5366 vendor-advisory
- GLSA-202311-06 vendor-advisory