multipath-tools 0.7.7 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited in conjunction with CVE-2022-41974. Local users able to access /dev/shm can change symlinks in multipathd due to incorrect symlink handling, which could lead to controlled file writes outside of the /dev/shm directory. This could be used indirectly for local privilege escalation to root.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade device-mapper-multipath-develUpgrade device-mapper-multipathUpgrade kpartxUpgrade device-mapper-multipath-libsUpgrade libdmmp | May 15, 2023 | Oct 29, 2022 |
| Alpine Linux | — | Upgrade multipath-tools | Mar 21, 2024 | Oct 29, 2022 |
| Amazon_linux_2023 | — | Upgrade device-mapper-multipath-debuginfoUpgrade kpartx-debuginfoUpgrade kpartxUpgrade device-mapper-multipath-develUpgrade device-mapper-multipathUpgrade libdmmpUpgrade device-mapper-multipath-libs-debuginfoUpgrade device-mapper-multipath-libsUpgrade libdmmp-debuginfoUpgrade libdmmp-develUpgrade device-mapper-multipath-debugsource | Feb 17, 2025 | Oct 24, 2022 |
| Centos_linux | — | Upgrade device-mapper-multipath-debuginfoUpgrade kpartx-debuginfoUpgrade device-mapper-multipathUpgrade libdmmpUpgrade device-mapper-multipath-libs-debuginfoUpgrade kpartxUpgrade libdmmp-debuginfoUpgrade device-mapper-multipath-debugsourceUpgrade device-mapper-multipath-libs | May 15, 2023 | Oct 29, 2022 |
| Debian | — | Upgrade multipath-tools | Dec 30, 2022 | Oct 29, 2022 |
| Dell Powerstore Dsa2023173 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Jun 21, 2023 |
| Dell Powerstore Dsa2024120 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Mar 26, 2024 |
| Gentoo Linux | — | Upgrade sys-fs/multipath-tools. | Nov 27, 2023 | Oct 29, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade multipath-toolsUpgrade kpartx | Feb 13, 2023 | Oct 29, 2022 |
| Huawei Euleros 2_0_sp11 | — | Upgrade kpartxUpgrade multipath-tools | Jan 6, 2023 | Oct 29, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade libdmmpUpgrade kpartxUpgrade device-mapper-multipathUpgrade device-mapper-multipath-develUpgrade device-mapper-multipath-libs | Feb 9, 2023 | Oct 29, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade kpartxUpgrade multipath-tools | Mar 9, 2023 | Oct 29, 2022 |
| Oracle_linux | — | Upgrade libdmmpUpgrade device-mapper-multipath-libsUpgrade device-mapper-multipathUpgrade kpartxUpgrade device-mapper-multipath-devel | May 17, 2023 | Oct 24, 2022 |
| Redhat_linux | — | Upgrade kpartx-debuginfoUpgrade device-mapper-multipath-libsUpgrade device-mapper-multipath-libs-debuginfoUpgrade libdmmp-debuginfoUpgrade device-mapper-multipath-develUpgrade libdmmpUpgrade device-mapper-multipath-debugsourceUpgrade device-mapper-multipathUpgrade kpartxUpgrade device-mapper-multipath-debuginfo | May 15, 2023 | Oct 29, 2022 |
| Suse | — | Upgrade kpartxUpgrade libmpath0Upgrade multipath-tools-develUpgrade libdmmp0_2_0Upgrade libdmmp-develUpgrade multipath-tools | Oct 26, 2022 | Oct 24, 2022 |
| Ubuntu | — | Upgrade multipath-tools | Nov 18, 2022 | Oct 24, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Oct 29, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub