A vulnerability was found in the device-mapper-multipath. The device-mapper-multipath allows local users to obtain root access, exploited alone or in conjunction with CVE-2022-41973. Local users that are able to write to UNIX domain sockets can bypass access controls and manipulate the multipath setup. This issue occurs because an attacker can repeat a keyword, which is mishandled when arithmetic ADD is used instead of bitwise OR. This could lead to local privilege escalation to root.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade device-mapper-multipath | Nov 15, 2022 | Nov 14, 2022 |
| Amazon_linux_2023 | — | Upgrade device-mapper-multipathUpgrade libdmmpUpgrade libdmmp-develUpgrade libdmmp-debuginfoUpgrade kpartx-debuginfoUpgrade device-mapper-multipath-develUpgrade device-mapper-multipath-debuginfoUpgrade device-mapper-multipath-debugsourceUpgrade device-mapper-multipath-libsUpgrade kpartxUpgrade device-mapper-multipath-libs-debuginfo | Feb 17, 2025 | Nov 7, 2022 |
| Centos_linux | — | Upgrade libdmmpUpgrade kpartx-debuginfoUpgrade device-mapper-multipath-debugsourceUpgrade device-mapper-multipath-debuginfoUpgrade device-mapper-multipathUpgrade libdmmp-debuginfoUpgrade device-mapper-multipath-libsUpgrade device-mapper-multipath-libs-debuginfoUpgrade kpartx | Nov 15, 2022 | Nov 14, 2022 |
| Oracle_linux | — | Upgrade device-mapper-multipath-develUpgrade device-mapper-multipathUpgrade libdmmpUpgrade device-mapper-multipath-libsUpgrade kpartx | Nov 17, 2022 | Nov 7, 2022 |
| Redhat_linux | — | Upgrade device-mapper-multipath-libsUpgrade device-mapper-multipathUpgrade device-mapper-multipath-libs-debuginfoUpgrade kpartxUpgrade device-mapper-multipath-debuginfoUpgrade kpartx-debuginfoUpgrade libdmmp-debuginfoUpgrade device-mapper-multipath-develUpgrade device-mapper-multipath-debugsourceUpgrade libdmmp | Nov 15, 2022 | Nov 14, 2022 |
| Rocky_linux | — | Upgrade kpartx-debuginfoUpgrade device-mapper-multipath-develUpgrade libdmmpUpgrade device-mapper-multipathUpgrade device-mapper-multipath-debuginfoUpgrade device-mapper-multipath-libsUpgrade device-mapper-multipath-libs-debuginfoUpgrade libdmmp-debuginfoUpgrade device-mapper-multipath-debugsourceUpgrade kpartx | Mar 12, 2024 | Mar 29, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub