multipath-tools 0.7.7 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited in conjunction with CVE-2022-41974. Local users able to access /dev/shm can change symlinks in multipathd due to incorrect symlink handling, which could lead to controlled file writes outside of the /dev/shm directory. This could be used indirectly for local privilege escalation to root.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade device-mapper-multipathUpgrade device-mapper-multipath-develUpgrade libdmmpUpgrade kpartxUpgrade device-mapper-multipath-libs | May 15, 2023 | Oct 29, 2022 |
| Alpine Linux | — | Upgrade multipath-tools | Mar 21, 2024 | Oct 29, 2022 |
| Amazon_linux_2023 | — | Upgrade device-mapper-multipath-debugsourceUpgrade libdmmp-develUpgrade device-mapper-multipath-libsUpgrade libdmmp-debuginfoUpgrade device-mapper-multipath-libs-debuginfoUpgrade kpartx-debuginfoUpgrade kpartxUpgrade device-mapper-multipath-debuginfoUpgrade device-mapper-multipathUpgrade libdmmpUpgrade device-mapper-multipath-devel | Feb 17, 2025 | Oct 24, 2022 |
| Centos_linux | — | Upgrade libdmmpUpgrade kpartx-debuginfoUpgrade device-mapper-multipath-libs-debuginfoUpgrade device-mapper-multipath-debuginfoUpgrade kpartxUpgrade device-mapper-multipathUpgrade device-mapper-multipath-libsUpgrade libdmmp-debuginfoUpgrade device-mapper-multipath-debugsource | May 15, 2023 | Oct 29, 2022 |
| Debian | — | Upgrade multipath-tools | Dec 30, 2022 | Oct 29, 2022 |
| Dell Powerstore Dsa2023173 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Jun 21, 2023 |
| Dell Powerstore Dsa2024120 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Mar 26, 2024 |
| Gentoo Linux | — | Upgrade sys-fs/multipath-tools. | Nov 27, 2023 | Oct 29, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade multipath-toolsUpgrade kpartx | Feb 13, 2023 | Oct 29, 2022 |
| Huawei Euleros 2_0_sp11 | — | Upgrade kpartxUpgrade multipath-tools | Jan 6, 2023 | Oct 29, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade kpartxUpgrade libdmmpUpgrade device-mapper-multipathUpgrade device-mapper-multipath-libsUpgrade device-mapper-multipath-devel | Feb 9, 2023 | Oct 29, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade kpartxUpgrade multipath-tools | Mar 9, 2023 | Oct 29, 2022 |
| Oracle_linux | — | Upgrade kpartxUpgrade device-mapper-multipath-develUpgrade device-mapper-multipath-libsUpgrade libdmmpUpgrade device-mapper-multipath | May 17, 2023 | Oct 24, 2022 |
| Redhat_linux | — | Upgrade kpartxUpgrade device-mapper-multipath-debuginfoUpgrade device-mapper-multipathUpgrade device-mapper-multipath-libsUpgrade device-mapper-multipath-debugsourceUpgrade device-mapper-multipath-libs-debuginfoUpgrade device-mapper-multipath-develUpgrade libdmmpUpgrade libdmmp-debuginfoUpgrade kpartx-debuginfo | May 15, 2023 | Oct 29, 2022 |
| Suse | — | Upgrade libmpath0Upgrade multipath-tools-develUpgrade kpartxUpgrade libdmmp0_2_0Upgrade libdmmp-develUpgrade multipath-tools | Oct 26, 2022 | Oct 24, 2022 |
| Ubuntu | — | Upgrade multipath-tools | Nov 18, 2022 | Oct 24, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Oct 29, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub