{"api_version":"1","generated_at":"2026-07-23T15:32:35+00:00","cve":"CVE-2022-41973","urls":{"html":"https://cve.report/CVE-2022-41973","api":"https://cve.report/api/cve/CVE-2022-41973.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2022-41973","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2022-41973"},"summary":{"title":"CVE-2022-41973","description":"multipath-tools 0.7.7 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited in conjunction with CVE-2022-41974. Local users able to access /dev/shm can change symlinks in multipathd due to incorrect symlink handling, which could lead to controlled file writes outside of the /dev/shm directory. This could be used indirectly for local privilege escalation to root.","state":"PUBLIC","assigner":"cve@mitre.org","published_at":"2022-10-29 18:15:00","updated_at":"2023-11-25 09:15:00"},"problem_types":["CWE-59"],"metrics":[],"references":[{"url":"http://packetstormsecurity.com/files/170176/snap-confine-must_mkdir_and_open_with_perms-Race-Condition.html","name":"http://packetstormsecurity.com/files/170176/snap-confine-must_mkdir_and_open_with_perms-Race-Condition.html","refsource":"MISC","tags":[],"title":"snap-confine must_mkdir_and_open_with_perms() Race Condition ≈ Packet Storm","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.qualys.com/2022/10/24/leeloo-multipath/leeloo-multipath.txt","name":"https://www.qualys.com/2022/10/24/leeloo-multipath/leeloo-multipath.txt","refsource":"MISC","tags":[],"title":"","mime":"text/plain","httpstatus":"200","archivestatus":"200"},{"url":"https://bugzilla.suse.com/show_bug.cgi?id=1202739","name":"https://bugzilla.suse.com/show_bug.cgi?id=1202739","refsource":"MISC","tags":[],"title":"Bug 1202739 – VUL-0: CVE-2022-41973,CVE-2022-41974: multipath-tools: multipathd: authorization bypass and symlink attack \"Leeloo Multipath\"","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QIGZM5NOOMFDCITOLQEJNNX5SCRQLQVV/","name":"FEDORA-2022-6ec78b2586","refsource":"FEDORA","tags":[],"title":"[SECURITY] Fedora 36 Update: device-mapper-multipath-0.8.7-9.fc36 - package-announce - Fedora Mailing-Lists","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://github.com/opensvc/multipath-tools/releases/tag/0.9.2","name":"https://github.com/opensvc/multipath-tools/releases/tag/0.9.2","refsource":"MISC","tags":[],"title":"Release 0.9.2: Merge pull request #46 from openSUSE/queue · opensvc/multipath-tools · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.debian.org/security/2023/dsa-5366","name":"DSA-5366","refsource":"DEBIAN","tags":[],"title":"Debian -- Security Information -- DSA-5366-1 multipath-tools","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QIGZM5NOOMFDCITOLQEJNNX5SCRQLQVV/","name":"FEDORA-2022-6ec78b2586","refsource":"","tags":[],"title":"[SECURITY] Fedora 36 Update: device-mapper-multipath-0.8.7-9.fc36 - package-announce - Fedora Mailing-Lists","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://seclists.org/fulldisclosure/2022/Dec/4","name":"20221208 Race condition in snap-confine's must_mkdir_and_open_with_perms() (CVE-2022-3328)","refsource":"FULLDISC","tags":[],"title":"Full Disclosure: Race condition in snap-confine's must_mkdir_and_open_with_perms() (CVE-2022-3328)","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"http://www.openwall.com/lists/oss-security/2022/11/30/2","name":"[oss-security] 20221130 Race condition in snap-confine's must_mkdir_and_open_with_perms() (CVE-2022-3328)","refsource":"MLIST","tags":[],"title":"oss-security - Race condition in snap-confine's must_mkdir_and_open_with_perms()\n (CVE-2022-3328)","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"http://packetstormsecurity.com/files/169611/Leeloo-Multipath-Authorization-Bypass-Symlink-Attack.html","name":"http://packetstormsecurity.com/files/169611/Leeloo-Multipath-Authorization-Bypass-Symlink-Attack.html","refsource":"MISC","tags":[],"title":"Leeloo Multipath Authorization Bypass / Symlink Attack ≈ Packet Storm","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"http://seclists.org/fulldisclosure/2022/Oct/25","name":"20221030 Authorization bypass and symlink attack in multipathd (CVE-2022-41974 and CVE-2022-41973)","refsource":"FULLDISC","tags":[],"title":"Full Disclosure: Authorization bypass and symlink attack in multipathd (CVE-2022-41974 and CVE-2022-41973)","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://lists.debian.org/debian-lts-announce/2022/12/msg00037.html","name":"[debian-lts-announce] 20221229 [SECURITY] [DLA 3250-1] multipath-tools security update","refsource":"MLIST","tags":[],"title":"[SECURITY] [DLA 3250-1] multipath-tools security update","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"http://www.openwall.com/lists/oss-security/2022/10/24/2","name":"http://www.openwall.com/lists/oss-security/2022/10/24/2","refsource":"MISC","tags":[],"title":"oss-security - Authorization bypass and symlink attack in multipathd (CVE-2022-41974\n and CVE-2022-41973)","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://security.gentoo.org/glsa/202311-06","name":"GLSA-202311-06","refsource":"","tags":[],"title":"multipath-tools: Multiple Vulnerabilities (GLSA 202311-06) — Gentoo security","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-41973","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-41973","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2022","cve_id":"41973","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"debian","cpe5":"debian_linux","cpe6":"10.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2022","cve_id":"41973","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"fedoraproject","cpe5":"fedora","cpe6":"36","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2022","cve_id":"41973","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"opensvc","cpe5":"multipath-tools","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[{"cve":"CVE-2022-41973","qid":"160602","title":"Oracle Enterprise Linux Security Update for device-mapper-multipath (ELSA-2023-2459)"},{"cve":"CVE-2022-41973","qid":"160681","title":"Oracle Enterprise Linux Security Update for device-mapper-multipath (ELSA-2023-2948)"},{"cve":"CVE-2022-41973","qid":"181449","title":"Debian Security Update for multipath-tools (DLA 3250-1)"},{"cve":"CVE-2022-41973","qid":"181659","title":"Debian Security Update for multipath-tools (DSA 5366-1)"},{"cve":"CVE-2022-41973","qid":"184232","title":"Debian Security Update for multipath-tools (CVE-2022-41973)"},{"cve":"CVE-2022-41973","qid":"199001","title":"Authorization bypass and symlink attack in multipathd (Leeloo Multipath)"},{"cve":"CVE-2022-41973","qid":"199033","title":"Ubuntu Security Notification for multipath-tools Vulnerabilities (USN-5731-1)"},{"cve":"CVE-2022-41973","qid":"241434","title":"Red Hat Update for device-mapper-multipath (RHSA-2023:2459)"},{"cve":"CVE-2022-41973","qid":"241530","title":"Red Hat Update for device-mapper-multipath (RHSA-2023:2948)"},{"cve":"CVE-2022-41973","qid":"243016","title":"Red Hat Update for device-mapper-multipath (RHSA-2024:1110)"},{"cve":"CVE-2022-41973","qid":"283303","title":"Fedora Security Update for device (FEDORA-2022-6ec78b2586)"},{"cve":"CVE-2022-41973","qid":"355168","title":"Amazon Linux Security Advisory for device-mapper-multipath : ALAS2023-2023-126"},{"cve":"CVE-2022-41973","qid":"378642","title":"Alibaba Cloud Linux Security Update for device-mapper-multipath (ALINUX3-SA-2023:0066)"},{"cve":"CVE-2022-41973","qid":"672499","title":"EulerOS Security Update for multipath-tools (EulerOS-SA-2023-1042)"},{"cve":"CVE-2022-41973","qid":"672501","title":"EulerOS Security Update for multipath-tools (EulerOS-SA-2023-1017)"},{"cve":"CVE-2022-41973","qid":"672593","title":"EulerOS Security Update for device-mapper-multipath (EulerOS-SA-2023-1310)"},{"cve":"CVE-2022-41973","qid":"672649","title":"EulerOS Security Update for multipath-tools (EulerOS-SA-2023-1394)"},{"cve":"CVE-2022-41973","qid":"672654","title":"EulerOS Security Update for multipath-tools (EulerOS-SA-2023-1366)"},{"cve":"CVE-2022-41973","qid":"672720","title":"EulerOS Security Update for multipath-tools (EulerOS-SA-2023-1452)"},{"cve":"CVE-2022-41973","qid":"672723","title":"EulerOS Security Update for multipath-tools (EulerOS-SA-2023-1477)"},{"cve":"CVE-2022-41973","qid":"710790","title":"Gentoo Linux multipath-tools Multiple Vulnerabilities (GLSA 202311-06)"},{"cve":"CVE-2022-41973","qid":"752703","title":"SUSE Enterprise Linux Security Update for multipath-tools (SUSE-SU-2022:3707-1)"},{"cve":"CVE-2022-41973","qid":"752706","title":"SUSE Enterprise Linux Security Update for multipath-tools (SUSE-SU-2022:3711-1)"},{"cve":"CVE-2022-41973","qid":"752707","title":"SUSE Enterprise Linux Security Update for multipath-tools (SUSE-SU-2022:3710-1)"},{"cve":"CVE-2022-41973","qid":"752709","title":"SUSE Enterprise Linux Security Update for multipath-tools (SUSE-SU-2022:3709-1)"},{"cve":"CVE-2022-41973","qid":"752711","title":"SUSE Enterprise Linux Security Update for multipath-tools (SUSE-SU-2022:3708-1)"},{"cve":"CVE-2022-41973","qid":"904436","title":"Common Base Linux Mariner (CBL-Mariner) Security Update for device-mapper-multipath (11413)"},{"cve":"CVE-2022-41973","qid":"904472","title":"Common Base Linux Mariner (CBL-Mariner) Security Update for device-mapper-multipath (11371)"},{"cve":"CVE-2022-41973","qid":"905242","title":"Common Base Linux Mariner (CBL-Mariner) Security Update for device-mapper-multipath (11371-1)"},{"cve":"CVE-2022-41973","qid":"941057","title":"AlmaLinux Security Update for device-mapper-multipath (ALSA-2023:2459)"},{"cve":"CVE-2022-41973","qid":"941072","title":"AlmaLinux Security Update for device-mapper-multipath (ALSA-2023:2948)"}]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2022-41973","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"multipath-tools 0.7.7 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited in conjunction with CVE-2022-41974. Local users able to access /dev/shm can change symlinks in multipathd due to incorrect symlink handling, which could lead to controlled file writes outside of the /dev/shm directory. This could be used indirectly for local privilege escalation to root."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"url":"https://bugzilla.suse.com/show_bug.cgi?id=1202739","refsource":"MISC","name":"https://bugzilla.suse.com/show_bug.cgi?id=1202739"},{"refsource":"MISC","name":"https://github.com/opensvc/multipath-tools/releases/tag/0.9.2","url":"https://github.com/opensvc/multipath-tools/releases/tag/0.9.2"},{"refsource":"MISC","name":"http://www.openwall.com/lists/oss-security/2022/10/24/2","url":"http://www.openwall.com/lists/oss-security/2022/10/24/2"},{"refsource":"FULLDISC","name":"20221030 Authorization bypass and symlink attack in multipathd (CVE-2022-41974 and CVE-2022-41973)","url":"http://seclists.org/fulldisclosure/2022/Oct/25"},{"refsource":"MISC","name":"http://packetstormsecurity.com/files/169611/Leeloo-Multipath-Authorization-Bypass-Symlink-Attack.html","url":"http://packetstormsecurity.com/files/169611/Leeloo-Multipath-Authorization-Bypass-Symlink-Attack.html"},{"refsource":"FEDORA","name":"FEDORA-2022-6ec78b2586","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QIGZM5NOOMFDCITOLQEJNNX5SCRQLQVV/"},{"refsource":"MISC","name":"https://www.qualys.com/2022/10/24/leeloo-multipath/leeloo-multipath.txt","url":"https://www.qualys.com/2022/10/24/leeloo-multipath/leeloo-multipath.txt"},{"refsource":"MLIST","name":"[oss-security] 20221130 Race condition in snap-confine's must_mkdir_and_open_with_perms() (CVE-2022-3328)","url":"http://www.openwall.com/lists/oss-security/2022/11/30/2"},{"refsource":"FULLDISC","name":"20221208 Race condition in snap-confine's must_mkdir_and_open_with_perms() (CVE-2022-3328)","url":"http://seclists.org/fulldisclosure/2022/Dec/4"},{"refsource":"MISC","name":"http://packetstormsecurity.com/files/170176/snap-confine-must_mkdir_and_open_with_perms-Race-Condition.html","url":"http://packetstormsecurity.com/files/170176/snap-confine-must_mkdir_and_open_with_perms-Race-Condition.html"},{"refsource":"MLIST","name":"[debian-lts-announce] 20221229 [SECURITY] [DLA 3250-1] multipath-tools security update","url":"https://lists.debian.org/debian-lts-announce/2022/12/msg00037.html"},{"refsource":"DEBIAN","name":"DSA-5366","url":"https://www.debian.org/security/2023/dsa-5366"}]}},"nvd":{"publishedDate":"2022-10-29 18:15:00","lastModifiedDate":"2023-11-25 09:15:00","problem_types":["CWE-59"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:opensvc:multipath-tools:*:*:*:*:*:*:*:*","versionStartIncluding":"0.7.7","versionEndExcluding":"0.9.2","cpe_name":[]}]},{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*","cpe_name":[]}]},{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":null,"notes":[]}}}