CVE-2022-41974

MITRE NVD CVE.ORG JSON API Print: PDF PDF

Summary

CVECVE-2022-41974
StatePUBLIC
Assigner[email protected]
Source PriorityCVE Program / NVD first with legacy fallback
Published2022-10-29 19:15:00 UTC
Updated2023-11-25 09:15:00 UTC
Descriptionmultipath-tools 0.7.0 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited alone or in conjunction with CVE-2022-41973. Local users able to write to UNIX domain sockets can bypass access controls and manipulate the multipath setup. This can lead to local privilege escalation to root. This occurs because an attacker can repeat a keyword, which is mishandled because arithmetic ADD is used instead of bitwise OR.

Risk And Classification

Problem Types: CWE-269

NVD Known Affected Configurations (CPE 2.3)

TypeVendorProductVersionUpdateEditionLanguage
Operating System Debian Debian Linux 10.0 All All All
Operating System Debian Debian Linux 11.0 All All All
Operating System Fedoraproject Fedora 36 All All All
Application Opensvc Multipath-tools All All All All

References

ReferenceSourceLinkTags
snap-confine must_mkdir_and_open_with_perms() Race Condition ≈ Packet Storm MISC packetstormsecurity.com
www.qualys.com/2022/10/24/leeloo-multipath/leeloo-multipath.txt MISC www.qualys.com
Bug 1202739 – VUL-0: CVE-2022-41973,CVE-2022-41974: multipath-tools: multipathd: authorization bypass and symlink attack "Leeloo Multipath" MISC bugzilla.suse.com
[SECURITY] Fedora 36 Update: device-mapper-multipath-0.8.7-9.fc36 - package-announce - Fedora Mailing-Lists FEDORA lists.fedoraproject.org
Release 0.9.2: Merge pull request #46 from openSUSE/queue · opensvc/multipath-tools · GitHub MISC github.com
Debian -- Security Information -- DSA-5366-1 multipath-tools DEBIAN www.debian.org
[SECURITY] Fedora 36 Update: device-mapper-multipath-0.8.7-9.fc36 - package-announce - Fedora Mailing-Lists lists.fedoraproject.org
Full Disclosure: Race condition in snap-confine's must_mkdir_and_open_with_perms() (CVE-2022-3328) FULLDISC seclists.org
oss-security - Race condition in snap-confine's must_mkdir_and_open_with_perms() (CVE-2022-3328) MLIST www.openwall.com
Leeloo Multipath Authorization Bypass / Symlink Attack ≈ Packet Storm MISC packetstormsecurity.com
Full Disclosure: Authorization bypass and symlink attack in multipathd (CVE-2022-41974 and CVE-2022-41973) FULLDISC seclists.org
[SECURITY] [DLA 3250-1] multipath-tools security update MLIST lists.debian.org
oss-security - Authorization bypass and symlink attack in multipathd (CVE-2022-41974 and CVE-2022-41973) MISC www.openwall.com
multipath-tools: Multiple Vulnerabilities (GLSA 202311-06) — Gentoo security security.gentoo.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

Legacy QID Mappings

  • 160167 Oracle Enterprise Linux Security Update for device-mapper-multipath (ELSA-2022-7186)
  • 160174 Oracle Enterprise Linux Security Update for device-mapper-multipath (ELSA-2022-7192)
  • 160178 Oracle Enterprise Linux Security Update for device-mapper-multipath (ELSA-2022-7185)
  • 181449 Debian Security Update for multipath-tools (DLA 3250-1)
  • 181659 Debian Security Update for multipath-tools (DSA 5366-1)
  • 184918 Debian Security Update for multipath-tools (CVE-2022-41974)
  • 199001 Authorization bypass and symlink attack in multipathd (Leeloo Multipath)
  • 199033 Ubuntu Security Notification for multipath-tools Vulnerabilities (USN-5731-1)
  • 240785 Red Hat Update for device-mapper-multipath (RHSA-2022:7186)
  • 240788 Red Hat Update for device-mapper-multipath (RHSA-2022:7185)
  • 240789 Red Hat Update for device-mapper-multipath (RHSA-2022:7188)
  • 240790 Red Hat Update for device-mapper-multipath (RHSA-2022:7192)
  • 240793 Red Hat Update for device-mapper-multipath (RHSA-2022:7191)
  • 257206 CentOS Security Update for device-mapper-multipath Security Update (CESA-2022:7186)
  • 283303 Fedora Security Update for device (FEDORA-2022-6ec78b2586)
  • 354137 Amazon Linux Security Advisory for device-mapper-multipath : ALAS2-2022-1883
  • 355168 Amazon Linux Security Advisory for device-mapper-multipath : ALAS2023-2023-126
  • 355243 Amazon Linux Security Advisory for device-mapper-multipath : ALAS2023-2023-141
  • 377742 Alibaba Cloud Linux Security Update for device-mapper-multipath (ALINUX2-SA-2022:0050)
  • 377748 Alibaba Cloud Linux Security Update for device-mapper-multipath (ALINUX3-SA-2022:0177)
  • 672593 EulerOS Security Update for device-mapper-multipath (EulerOS-SA-2023-1310)
  • 672649 EulerOS Security Update for multipath-tools (EulerOS-SA-2023-1394)
  • 672654 EulerOS Security Update for multipath-tools (EulerOS-SA-2023-1366)
  • 672682 EulerOS Security Update for multipath-tools (EulerOS-SA-2023-1428)
  • 672686 EulerOS Security Update for multipath-tools (EulerOS-SA-2023-1413)
  • 672720 EulerOS Security Update for multipath-tools (EulerOS-SA-2023-1452)
  • 672723 EulerOS Security Update for multipath-tools (EulerOS-SA-2023-1477)
  • 673061 EulerOS Security Update for device-mapper-multipath (EulerOS-SA-2023-2140)
  • 710790 Gentoo Linux multipath-tools Multiple Vulnerabilities (GLSA 202311-06)
  • 752703 SUSE Enterprise Linux Security Update for multipath-tools (SUSE-SU-2022:3707-1)
  • 752704 SUSE Enterprise Linux Security Update for multipath-tools (SUSE-SU-2022:3713-1)
  • 752705 SUSE Enterprise Linux Security Update for multipath-tools (SUSE-SU-2022:3712-1)
  • 752706 SUSE Enterprise Linux Security Update for multipath-tools (SUSE-SU-2022:3711-1)
  • 752707 SUSE Enterprise Linux Security Update for multipath-tools (SUSE-SU-2022:3710-1)
  • 752709 SUSE Enterprise Linux Security Update for multipath-tools (SUSE-SU-2022:3709-1)
  • 752711 SUSE Enterprise Linux Security Update for multipath-tools (SUSE-SU-2022:3708-1)
  • 904435 Common Base Linux Mariner (CBL-Mariner) Security Update for device-mapper-multipath (11414)
  • 904473 Common Base Linux Mariner (CBL-Mariner) Security Update for device-mapper-multipath (11373)
  • 905241 Common Base Linux Mariner (CBL-Mariner) Security Update for device-mapper-multipath (11373-1)
  • 940707 AlmaLinux Security Update for device-mapper-multipath (ALSA-2022:7192)
  • 940713 AlmaLinux Security Update for device-mapper-multipath (ALSA-2022:7185)
  • 960200 Rocky Linux Security Update for device-mapper-multipath (RLSA-2022:7192)
  • 960501 Rocky Linux Security Update for device-mapper-multipath (RLSA-2022:7185)

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report