A vulnerability was found in the device-mapper-multipath. The device-mapper-multipath allows local users to obtain root access, exploited alone or in conjunction with CVE-2022-41973. Local users that are able to write to UNIX domain sockets can bypass access controls and manipulate the multipath setup. This issue occurs because an attacker can repeat a keyword, which is mishandled when arithmetic ADD is used instead of bitwise OR. This could lead to local privilege escalation to root.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade device-mapper-multipath | Nov 15, 2022 | Nov 14, 2022 |
| Amazon_linux_2023 | — | Upgrade device-mapper-multipath-libs-debuginfoUpgrade device-mapper-multipath-libsUpgrade kpartxUpgrade kpartx-debuginfoUpgrade device-mapper-multipathUpgrade device-mapper-multipath-debugsourceUpgrade libdmmpUpgrade libdmmp-develUpgrade device-mapper-multipath-debuginfoUpgrade libdmmp-debuginfoUpgrade device-mapper-multipath-devel | Feb 17, 2025 | Nov 7, 2022 |
| Centos_linux | — | Upgrade device-mapper-multipath-libs-debuginfoUpgrade kpartxUpgrade device-mapper-multipath-libsUpgrade device-mapper-multipath-debuginfoUpgrade kpartx-debuginfoUpgrade device-mapper-multipath-debugsourceUpgrade libdmmpUpgrade device-mapper-multipathUpgrade libdmmp-debuginfo | Nov 15, 2022 | Nov 14, 2022 |
| Oracle_linux | — | Upgrade libdmmpUpgrade device-mapper-multipath-libsUpgrade kpartxUpgrade device-mapper-multipathUpgrade device-mapper-multipath-devel | Nov 17, 2022 | Nov 7, 2022 |
| Redhat_linux | — | Upgrade kpartxUpgrade device-mapper-multipath-libs-debuginfoUpgrade device-mapper-multipath-libsUpgrade device-mapper-multipathUpgrade libdmmpUpgrade device-mapper-multipath-debuginfoUpgrade libdmmp-debuginfoUpgrade kpartx-debuginfoUpgrade device-mapper-multipath-debugsourceUpgrade device-mapper-multipath-devel | Nov 15, 2022 | Nov 14, 2022 |
| Rocky_linux | — | Upgrade libdmmpUpgrade kpartx-debuginfoUpgrade device-mapper-multipath-develUpgrade device-mapper-multipath-libsUpgrade device-mapper-multipath-libs-debuginfoUpgrade device-mapper-multipath-debuginfoUpgrade device-mapper-multipathUpgrade kpartxUpgrade device-mapper-multipath-debugsourceUpgrade libdmmp-debuginfo | Mar 12, 2024 | Mar 29, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub