CVE-2022-41973

multipath-tools 0.7.7 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited in conjunction with CVE-2022-41974. Local users able to access /dev/shm can change symlinks in multipathd due to incorrect symlink handling, which could lead to controlled file writes outside of the /dev/shm directory. This could be used indirectly for local privilege escalation to root.
Link Following
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.8 HIGH
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 47%
Affected Products (NVD)
VendorProductVersion
opensvcmultipath-tools
0.7.7 ≤
𝑥
< 0.9.2
debiandebian_linux
10.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
multipath-tools
bookworm
0.9.4-3+deb12u1
fixed
bullseye
0.8.5-2+deb11u1
fixed
bullseye (security)
0.8.5-2+deb11u1
fixed
sid
0.9.9-1
fixed
trixie
0.9.9-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
multipath-tools
bionic
not-affected
focal
Fixed 0.8.3-1ubuntu2.1
released
jammy
Fixed 0.8.8-1ubuntu1.22.04.1
released
kinetic
Fixed 0.8.8-1ubuntu1.22.10.1
released
trusty
not-affected
xenial
not-affected
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
device-mapper-multipath
RHEL 8
0:0.8.4-37.el8
fixed
RHEL 8.6 AUS
0:0.8.4-22.el8_6.5
fixed
RHEL 8.6 E4S
0:0.8.4-22.el8_6.5
fixed
RHEL 8.6 EUS
0:0.8.4-22.el8_6.5
fixed
RHEL 8.6 TUS
0:0.8.4-22.el8_6.5
fixed
RHEL 9
0:0.8.7-20.el9
fixed
device-mapper-multipath-devel
RHEL 8
0:0.8.4-37.el8
fixed
RHEL 8.6 AUS
0:0.8.4-22.el8_6.5
fixed
RHEL 8.6 E4S
0:0.8.4-22.el8_6.5
fixed
RHEL 8.6 EUS
0:0.8.4-22.el8_6.5
fixed
RHEL 8.6 TUS
0:0.8.4-22.el8_6.5
fixed
RHEL 9
0:0.8.7-20.el9
fixed
device-mapper-multipath-libs
RHEL 8
0:0.8.4-37.el8
fixed
RHEL 8.6 AUS
0:0.8.4-22.el8_6.5
fixed
RHEL 8.6 E4S
0:0.8.4-22.el8_6.5
fixed
RHEL 8.6 EUS
0:0.8.4-22.el8_6.5
fixed
RHEL 8.6 TUS
0:0.8.4-22.el8_6.5
fixed
RHEL 9
0:0.8.7-20.el9
fixed
kpartx
RHEL 8
0:0.8.4-37.el8
fixed
RHEL 8.6 AUS
0:0.8.4-22.el8_6.5
fixed
RHEL 8.6 E4S
0:0.8.4-22.el8_6.5
fixed
RHEL 8.6 EUS
0:0.8.4-22.el8_6.5
fixed
RHEL 8.6 TUS
0:0.8.4-22.el8_6.5
fixed
RHEL 9
0:0.8.7-20.el9
fixed
libdmmp
RHEL 8
0:0.8.4-37.el8
fixed
RHEL 8.6 AUS
0:0.8.4-22.el8_6.5
fixed
RHEL 8.6 E4S
0:0.8.4-22.el8_6.5
fixed
RHEL 8.6 EUS
0:0.8.4-22.el8_6.5
fixed
RHEL 8.6 TUS
0:0.8.4-22.el8_6.5
fixed
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
device-mapper-multipath
Amazon Linux 2023
0:0.8.7-16.amzn2023.0.1
fixed
device-mapper-multipath-debuginfo
Amazon Linux 2023
0:0.8.7-16.amzn2023.0.1
fixed
device-mapper-multipath-debugsource
Amazon Linux 2023
0:0.8.7-16.amzn2023.0.1
fixed
device-mapper-multipath-devel
Amazon Linux 2023
0:0.8.7-16.amzn2023.0.1
fixed
device-mapper-multipath-libs
Amazon Linux 2023
0:0.8.7-16.amzn2023.0.1
fixed
device-mapper-multipath-libs-debuginfo
Amazon Linux 2023
0:0.8.7-16.amzn2023.0.1
fixed
kpartx
Amazon Linux 2023
0:0.8.7-16.amzn2023.0.1
fixed
kpartx-debuginfo
Amazon Linux 2023
0:0.8.7-16.amzn2023.0.1
fixed
libdmmp
Amazon Linux 2023
0:0.8.7-16.amzn2023.0.1
fixed
libdmmp-debuginfo
Amazon Linux 2023
0:0.8.7-16.amzn2023.0.1
fixed
libdmmp-devel
Amazon Linux 2023
0:0.8.7-16.amzn2023.0.1
fixed
Azure Linux logo
Azure Linux Releases
Azure Package
Release
device-mapper-multipath
CBL-Mariner 2.0
0:0.8.6-4.cm2
fixed
Common Weakness Enumeration
References
http://packetstormsecurity.com/files/169611/Leeloo-Multipath-Authorization-Bypass-Symlink-Attack.html
http://packetstormsecurity.com/files/170176/snap-confine-must_mkdir_and_open_with_perms-Race-Condition.html
http://seclists.org/fulldisclosure/2022/Dec/4
http://seclists.org/fulldisclosure/2022/Oct/25
http://www.openwall.com/lists/oss-security/2022/10/24/2
http://www.openwall.com/lists/oss-security/2022/11/30/2
https://bugzilla.suse.com/show_bug.cgi?id=1202739
https://github.com/opensvc/multipath-tools/releases/tag/0.9.2
https://lists.debian.org/debian-lts-announce/2022/12/msg00037.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QIGZM5NOOMFDCITOLQEJNNX5SCRQLQVV/
https://security.gentoo.org/glsa/202311-06
https://www.debian.org/security/2023/dsa-5366
https://www.qualys.com/2022/10/24/leeloo-multipath/leeloo-multipath.txt
http://packetstormsecurity.com/files/169611/Leeloo-Multipath-Authorization-Bypass-Symlink-Attack.html
http://packetstormsecurity.com/files/170176/snap-confine-must_mkdir_and_open_with_perms-Race-Condition.html
http://seclists.org/fulldisclosure/2022/Dec/4
http://seclists.org/fulldisclosure/2022/Oct/25
http://www.openwall.com/lists/oss-security/2022/10/24/2
http://www.openwall.com/lists/oss-security/2022/11/30/2
https://bugzilla.suse.com/show_bug.cgi?id=1202739
https://github.com/opensvc/multipath-tools/releases/tag/0.9.2
https://lists.debian.org/debian-lts-announce/2022/12/msg00037.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QIGZM5NOOMFDCITOLQEJNNX5SCRQLQVV/
https://security.gentoo.org/glsa/202311-06
https://www.debian.org/security/2023/dsa-5366
https://www.qualys.com/2022/10/24/leeloo-multipath/leeloo-multipath.txt