A vulnerability was found in the device-mapper-multipath. The device-mapper-multipath allows local users to obtain root access, exploited alone or in conjunction with CVE-2022-41973. Local users that are able to write to UNIX domain sockets can bypass access controls and manipulate the multipath setup. This issue occurs because an attacker can repeat a keyword, which is mishandled when arithmetic ADD is used instead of bitwise OR. This could lead to local privilege escalation to root.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade device-mapper-multipath | Nov 15, 2022 | Nov 14, 2022 |
| Amazon_linux_2023 | — | Upgrade device-mapper-multipath-libsUpgrade kpartxUpgrade device-mapper-multipath-libs-debuginfoUpgrade device-mapper-multipath-develUpgrade device-mapper-multipathUpgrade device-mapper-multipath-debugsourceUpgrade kpartx-debuginfoUpgrade libdmmp-develUpgrade libdmmpUpgrade device-mapper-multipath-debuginfoUpgrade libdmmp-debuginfo | Feb 17, 2025 | Nov 7, 2022 |
| Centos_linux | — | Upgrade libdmmpUpgrade libdmmp-debuginfoUpgrade device-mapper-multipath-debuginfoUpgrade kpartx-debuginfoUpgrade device-mapper-multipath-debugsourceUpgrade device-mapper-multipathUpgrade kpartxUpgrade device-mapper-multipath-libs-debuginfoUpgrade device-mapper-multipath-libs | Nov 15, 2022 | Nov 14, 2022 |
| Oracle_linux | — | Upgrade device-mapper-multipath-develUpgrade device-mapper-multipathUpgrade kpartxUpgrade device-mapper-multipath-libsUpgrade libdmmp | Nov 17, 2022 | Nov 7, 2022 |
| Redhat_linux | — | Upgrade device-mapper-multipath-debugsourceUpgrade kpartx-debuginfoUpgrade libdmmpUpgrade device-mapper-multipath-debuginfoUpgrade device-mapper-multipath-develUpgrade libdmmp-debuginfoUpgrade device-mapper-multipath-libsUpgrade kpartxUpgrade device-mapper-multipathUpgrade device-mapper-multipath-libs-debuginfo | Nov 15, 2022 | Nov 14, 2022 |
| Rocky_linux | — | Upgrade kpartx-debuginfoUpgrade libdmmpUpgrade device-mapper-multipath-develUpgrade device-mapper-multipath-debugsourceUpgrade device-mapper-multipathUpgrade device-mapper-multipath-libsUpgrade device-mapper-multipath-debuginfoUpgrade device-mapper-multipath-libs-debuginfoUpgrade libdmmp-debuginfoUpgrade kpartx | Mar 12, 2024 | Mar 29, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub