CVE-2022-41973
Summary
| CVE | CVE-2022-41973 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2022-10-29 18:15:00 UTC |
|---|
| Updated | 2023-11-25 09:15:00 UTC |
|---|
| Description | multipath-tools 0.7.7 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited in conjunction with CVE-2022-41974. Local users able to access /dev/shm can change symlinks in multipathd due to incorrect symlink handling, which could lead to controlled file writes outside of the /dev/shm directory. This could be used indirectly for local privilege escalation to root. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| snap-confine must_mkdir_and_open_with_perms() Race Condition ≈ Packet Storm |
MISC |
packetstormsecurity.com |
|
| www.qualys.com/2022/10/24/leeloo-multipath/leeloo-multipath.txt |
MISC |
www.qualys.com |
|
| Bug 1202739 – VUL-0: CVE-2022-41973,CVE-2022-41974: multipath-tools: multipathd: authorization bypass and symlink attack "Leeloo Multipath" |
MISC |
bugzilla.suse.com |
|
| [SECURITY] Fedora 36 Update: device-mapper-multipath-0.8.7-9.fc36 - package-announce - Fedora Mailing-Lists |
FEDORA |
lists.fedoraproject.org |
|
| Release 0.9.2: Merge pull request #46 from openSUSE/queue · opensvc/multipath-tools · GitHub |
MISC |
github.com |
|
| Debian -- Security Information -- DSA-5366-1 multipath-tools |
DEBIAN |
www.debian.org |
|
| [SECURITY] Fedora 36 Update: device-mapper-multipath-0.8.7-9.fc36 - package-announce - Fedora Mailing-Lists |
|
lists.fedoraproject.org |
|
| Full Disclosure: Race condition in snap-confine's must_mkdir_and_open_with_perms() (CVE-2022-3328) |
FULLDISC |
seclists.org |
|
| oss-security - Race condition in snap-confine's must_mkdir_and_open_with_perms()
(CVE-2022-3328) |
MLIST |
www.openwall.com |
|
| Leeloo Multipath Authorization Bypass / Symlink Attack ≈ Packet Storm |
MISC |
packetstormsecurity.com |
|
| Full Disclosure: Authorization bypass and symlink attack in multipathd (CVE-2022-41974 and CVE-2022-41973) |
FULLDISC |
seclists.org |
|
| [SECURITY] [DLA 3250-1] multipath-tools security update |
MLIST |
lists.debian.org |
|
| oss-security - Authorization bypass and symlink attack in multipathd (CVE-2022-41974
and CVE-2022-41973) |
MISC |
www.openwall.com |
|
| multipath-tools: Multiple Vulnerabilities (GLSA 202311-06) — Gentoo security |
|
security.gentoo.org |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 160602 Oracle Enterprise Linux Security Update for device-mapper-multipath (ELSA-2023-2459)
- 160681 Oracle Enterprise Linux Security Update for device-mapper-multipath (ELSA-2023-2948)
- 181449 Debian Security Update for multipath-tools (DLA 3250-1)
- 181659 Debian Security Update for multipath-tools (DSA 5366-1)
- 184232 Debian Security Update for multipath-tools (CVE-2022-41973)
- 199001 Authorization bypass and symlink attack in multipathd (Leeloo Multipath)
- 199033 Ubuntu Security Notification for multipath-tools Vulnerabilities (USN-5731-1)
- 241434 Red Hat Update for device-mapper-multipath (RHSA-2023:2459)
- 241530 Red Hat Update for device-mapper-multipath (RHSA-2023:2948)
- 243016 Red Hat Update for device-mapper-multipath (RHSA-2024:1110)
- 283303 Fedora Security Update for device (FEDORA-2022-6ec78b2586)
- 355168 Amazon Linux Security Advisory for device-mapper-multipath : ALAS2023-2023-126
- 378642 Alibaba Cloud Linux Security Update for device-mapper-multipath (ALINUX3-SA-2023:0066)
- 672499 EulerOS Security Update for multipath-tools (EulerOS-SA-2023-1042)
- 672501 EulerOS Security Update for multipath-tools (EulerOS-SA-2023-1017)
- 672593 EulerOS Security Update for device-mapper-multipath (EulerOS-SA-2023-1310)
- 672649 EulerOS Security Update for multipath-tools (EulerOS-SA-2023-1394)
- 672654 EulerOS Security Update for multipath-tools (EulerOS-SA-2023-1366)
- 672720 EulerOS Security Update for multipath-tools (EulerOS-SA-2023-1452)
- 672723 EulerOS Security Update for multipath-tools (EulerOS-SA-2023-1477)
- 710790 Gentoo Linux multipath-tools Multiple Vulnerabilities (GLSA 202311-06)
- 752703 SUSE Enterprise Linux Security Update for multipath-tools (SUSE-SU-2022:3707-1)
- 752706 SUSE Enterprise Linux Security Update for multipath-tools (SUSE-SU-2022:3711-1)
- 752707 SUSE Enterprise Linux Security Update for multipath-tools (SUSE-SU-2022:3710-1)
- 752709 SUSE Enterprise Linux Security Update for multipath-tools (SUSE-SU-2022:3709-1)
- 752711 SUSE Enterprise Linux Security Update for multipath-tools (SUSE-SU-2022:3708-1)
- 904436 Common Base Linux Mariner (CBL-Mariner) Security Update for device-mapper-multipath (11413)
- 904472 Common Base Linux Mariner (CBL-Mariner) Security Update for device-mapper-multipath (11371)
- 905242 Common Base Linux Mariner (CBL-Mariner) Security Update for device-mapper-multipath (11371-1)
- 941057 AlmaLinux Security Update for device-mapper-multipath (ALSA-2023:2459)
- 941072 AlmaLinux Security Update for device-mapper-multipath (ALSA-2023:2948)
