multipath-tools 0.7.7 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited in conjunction with CVE-2022-41974. Local users able to access /dev/shm can change symlinks in multipathd due to incorrect symlink handling, which could lead to controlled file writes outside of the /dev/shm directory. This could be used indirectly for local privilege escalation to root.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade device-mapper-multipathUpgrade device-mapper-multipath-develUpgrade device-mapper-multipath-libsUpgrade kpartxUpgrade libdmmp | May 15, 2023 | Oct 29, 2022 |
| Alpine Linux | — | Upgrade multipath-tools | Mar 21, 2024 | Oct 29, 2022 |
| Amazon_linux_2023 | — | Upgrade libdmmp-debuginfoUpgrade device-mapper-multipath-libsUpgrade libdmmp-develUpgrade device-mapper-multipath-libs-debuginfoUpgrade device-mapper-multipath-debugsourceUpgrade device-mapper-multipath-develUpgrade kpartx-debuginfoUpgrade device-mapper-multipath-debuginfoUpgrade device-mapper-multipathUpgrade libdmmpUpgrade kpartx | Feb 17, 2025 | Oct 24, 2022 |
| Centos_linux | — | Upgrade device-mapper-multipath-debugsourceUpgrade device-mapper-multipath-libsUpgrade libdmmp-debuginfoUpgrade device-mapper-multipath-debuginfoUpgrade kpartx-debuginfoUpgrade device-mapper-multipath-libs-debuginfoUpgrade libdmmpUpgrade kpartxUpgrade device-mapper-multipath | May 15, 2023 | Oct 29, 2022 |
| Debian | — | Upgrade multipath-tools | Dec 30, 2022 | Oct 29, 2022 |
| Dell Powerstore Dsa2023173 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Jun 21, 2023 |
| Dell Powerstore Dsa2024120 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Mar 26, 2024 |
| Gentoo Linux | — | Upgrade sys-fs/multipath-tools. | Nov 27, 2023 | Oct 29, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade multipath-toolsUpgrade kpartx | Feb 13, 2023 | Oct 29, 2022 |
| Huawei Euleros 2_0_sp11 | — | Upgrade kpartxUpgrade multipath-tools | Jan 6, 2023 | Oct 29, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade device-mapper-multipath-libsUpgrade device-mapper-multipath-develUpgrade libdmmpUpgrade device-mapper-multipathUpgrade kpartx | Feb 9, 2023 | Oct 29, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade kpartxUpgrade multipath-tools | Mar 9, 2023 | Oct 29, 2022 |
| Oracle_linux | — | Upgrade libdmmpUpgrade device-mapper-multipath-libsUpgrade device-mapper-multipathUpgrade kpartxUpgrade device-mapper-multipath-devel | May 17, 2023 | Oct 24, 2022 |
| Redhat_linux | — | Upgrade libdmmp-debuginfoUpgrade kpartx-debuginfoUpgrade device-mapper-multipath-debugsourceUpgrade libdmmpUpgrade device-mapper-multipath-develUpgrade device-mapper-multipath-libs-debuginfoUpgrade device-mapper-multipath-libsUpgrade device-mapper-multipath-debuginfoUpgrade device-mapper-multipathUpgrade kpartx | May 15, 2023 | Oct 29, 2022 |
| Suse | — | Upgrade multipath-tools-develUpgrade kpartxUpgrade libmpath0Upgrade libdmmp0_2_0Upgrade multipath-toolsUpgrade libdmmp-devel | Oct 26, 2022 | Oct 24, 2022 |
| Ubuntu | — | Upgrade multipath-tools | Nov 18, 2022 | Oct 24, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Oct 29, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub