A vulnerability was found in the device-mapper-multipath. The device-mapper-multipath allows local users to obtain root access, exploited alone or in conjunction with CVE-2022-41973. Local users that are able to write to UNIX domain sockets can bypass access controls and manipulate the multipath setup. This issue occurs because an attacker can repeat a keyword, which is mishandled when arithmetic ADD is used instead of bitwise OR. This could lead to local privilege escalation to root.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade device-mapper-multipath | Nov 15, 2022 | Nov 14, 2022 |
| Amazon_linux_2023 | — | Upgrade libdmmpUpgrade libdmmp-develUpgrade device-mapper-multipath-develUpgrade device-mapper-multipath-debugsourceUpgrade device-mapper-multipathUpgrade kpartx-debuginfoUpgrade libdmmp-debuginfoUpgrade device-mapper-multipath-debuginfoUpgrade kpartxUpgrade device-mapper-multipath-libs-debuginfoUpgrade device-mapper-multipath-libs | Feb 17, 2025 | Nov 7, 2022 |
| Centos_linux | — | Upgrade device-mapper-multipath-libsUpgrade device-mapper-multipath-libs-debuginfoUpgrade kpartxUpgrade device-mapper-multipathUpgrade kpartx-debuginfoUpgrade libdmmpUpgrade libdmmp-debuginfoUpgrade device-mapper-multipath-debugsourceUpgrade device-mapper-multipath-debuginfo | Nov 15, 2022 | Nov 14, 2022 |
| Oracle_linux | — | Upgrade device-mapper-multipath-libsUpgrade libdmmpUpgrade kpartxUpgrade device-mapper-multipathUpgrade device-mapper-multipath-devel | Nov 17, 2022 | Nov 7, 2022 |
| Redhat_linux | — | Upgrade kpartx-debuginfoUpgrade device-mapper-multipath-debuginfoUpgrade device-mapper-multipath-develUpgrade libdmmp-debuginfoUpgrade device-mapper-multipath-debugsourceUpgrade libdmmpUpgrade kpartxUpgrade device-mapper-multipath-libs-debuginfoUpgrade device-mapper-multipathUpgrade device-mapper-multipath-libs | Nov 15, 2022 | Nov 14, 2022 |
| Rocky_linux | — | Upgrade device-mapper-multipathUpgrade device-mapper-multipath-debugsourceUpgrade device-mapper-multipath-debuginfoUpgrade device-mapper-multipath-libsUpgrade device-mapper-multipath-libs-debuginfoUpgrade kpartxUpgrade libdmmp-debuginfoUpgrade kpartx-debuginfoUpgrade libdmmpUpgrade device-mapper-multipath-devel | Mar 12, 2024 | Mar 29, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub