multipath-tools 0.7.7 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited in conjunction with CVE-2022-41974. Local users able to access /dev/shm can change symlinks in multipathd due to incorrect symlink handling, which could lead to controlled file writes outside of the /dev/shm directory. This could be used indirectly for local privilege escalation to root.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade device-mapper-multipath-develUpgrade device-mapper-multipathUpgrade device-mapper-multipath-libsUpgrade kpartxUpgrade libdmmp | May 15, 2023 | Oct 29, 2022 |
| Alpine Linux | — | Upgrade multipath-tools | Mar 21, 2024 | Oct 29, 2022 |
| Amazon_linux_2023 | — | Upgrade kpartx-debuginfoUpgrade libdmmpUpgrade device-mapper-multipathUpgrade device-mapper-multipath-debuginfoUpgrade device-mapper-multipath-develUpgrade kpartxUpgrade device-mapper-multipath-debugsourceUpgrade libdmmp-debuginfoUpgrade device-mapper-multipath-libs-debuginfoUpgrade device-mapper-multipath-libsUpgrade libdmmp-devel | Feb 17, 2025 | Oct 24, 2022 |
| Centos_linux | — | Upgrade device-mapper-multipath-libsUpgrade device-mapper-multipath-debugsourceUpgrade libdmmp-debuginfoUpgrade device-mapper-multipath-debuginfoUpgrade libdmmpUpgrade kpartxUpgrade device-mapper-multipathUpgrade device-mapper-multipath-libs-debuginfoUpgrade kpartx-debuginfo | May 15, 2023 | Oct 29, 2022 |
| Debian | — | Upgrade multipath-tools | Dec 30, 2022 | Oct 29, 2022 |
| Dell Powerstore Dsa2023173 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Jun 21, 2023 |
| Dell Powerstore Dsa2024120 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Mar 26, 2024 |
| Gentoo Linux | — | Upgrade sys-fs/multipath-tools. | Nov 27, 2023 | Oct 29, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade kpartxUpgrade multipath-tools | Feb 13, 2023 | Oct 29, 2022 |
| Huawei Euleros 2_0_sp11 | — | Upgrade multipath-toolsUpgrade kpartx | Jan 6, 2023 | Oct 29, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade device-mapper-multipath-develUpgrade device-mapper-multipath-libsUpgrade libdmmpUpgrade kpartxUpgrade device-mapper-multipath | Feb 9, 2023 | Oct 29, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade multipath-toolsUpgrade kpartx | Mar 9, 2023 | Oct 29, 2022 |
| Oracle_linux | — | Upgrade device-mapper-multipathUpgrade device-mapper-multipath-libsUpgrade libdmmpUpgrade device-mapper-multipath-develUpgrade kpartx | May 17, 2023 | Oct 24, 2022 |
| Redhat_linux | — | Upgrade device-mapper-multipath-debuginfoUpgrade device-mapper-multipathUpgrade kpartxUpgrade libdmmpUpgrade device-mapper-multipath-libs-debuginfoUpgrade device-mapper-multipath-develUpgrade kpartx-debuginfoUpgrade device-mapper-multipath-libsUpgrade device-mapper-multipath-debugsourceUpgrade libdmmp-debuginfo | May 15, 2023 | Oct 29, 2022 |
| Suse | — | Upgrade libmpath0Upgrade multipath-tools-develUpgrade kpartxUpgrade libdmmp-develUpgrade libdmmp0_2_0Upgrade multipath-tools | Oct 26, 2022 | Oct 24, 2022 |
| Ubuntu | — | Upgrade multipath-tools | Nov 18, 2022 | Oct 24, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Oct 29, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub