{"api_version":"1","generated_at":"2026-07-24T20:14:51+00:00","cve":"CVE-2022-41974","urls":{"html":"https://cve.report/CVE-2022-41974","api":"https://cve.report/api/cve/CVE-2022-41974.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2022-41974","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2022-41974"},"summary":{"title":"CVE-2022-41974","description":"multipath-tools 0.7.0 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited alone or in conjunction with CVE-2022-41973. Local users able to write to UNIX domain sockets can bypass access controls and manipulate the multipath setup. This can lead to local privilege escalation to root. This occurs because an attacker can repeat a keyword, which is mishandled because arithmetic ADD is used instead of bitwise OR.","state":"PUBLIC","assigner":"cve@mitre.org","published_at":"2022-10-29 19:15:00","updated_at":"2023-11-25 09:15:00"},"problem_types":["CWE-269"],"metrics":[],"references":[{"url":"http://packetstormsecurity.com/files/170176/snap-confine-must_mkdir_and_open_with_perms-Race-Condition.html","name":"http://packetstormsecurity.com/files/170176/snap-confine-must_mkdir_and_open_with_perms-Race-Condition.html","refsource":"MISC","tags":[],"title":"snap-confine must_mkdir_and_open_with_perms() Race Condition ≈ Packet Storm","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.qualys.com/2022/10/24/leeloo-multipath/leeloo-multipath.txt","name":"https://www.qualys.com/2022/10/24/leeloo-multipath/leeloo-multipath.txt","refsource":"MISC","tags":[],"title":"","mime":"text/plain","httpstatus":"200","archivestatus":"200"},{"url":"https://bugzilla.suse.com/show_bug.cgi?id=1202739","name":"https://bugzilla.suse.com/show_bug.cgi?id=1202739","refsource":"MISC","tags":[],"title":"Bug 1202739 – VUL-0: CVE-2022-41973,CVE-2022-41974: multipath-tools: multipathd: authorization bypass and symlink attack \"Leeloo Multipath\"","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QIGZM5NOOMFDCITOLQEJNNX5SCRQLQVV/","name":"FEDORA-2022-6ec78b2586","refsource":"FEDORA","tags":[],"title":"[SECURITY] Fedora 36 Update: device-mapper-multipath-0.8.7-9.fc36 - package-announce - Fedora Mailing-Lists","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://github.com/opensvc/multipath-tools/releases/tag/0.9.2","name":"https://github.com/opensvc/multipath-tools/releases/tag/0.9.2","refsource":"MISC","tags":[],"title":"Release 0.9.2: Merge pull request #46 from openSUSE/queue · opensvc/multipath-tools · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.debian.org/security/2023/dsa-5366","name":"DSA-5366","refsource":"DEBIAN","tags":[],"title":"Debian -- Security Information -- DSA-5366-1 multipath-tools","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QIGZM5NOOMFDCITOLQEJNNX5SCRQLQVV/","name":"FEDORA-2022-6ec78b2586","refsource":"","tags":[],"title":"[SECURITY] Fedora 36 Update: device-mapper-multipath-0.8.7-9.fc36 - package-announce - Fedora Mailing-Lists","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://seclists.org/fulldisclosure/2022/Dec/4","name":"20221208 Race condition in snap-confine's must_mkdir_and_open_with_perms() (CVE-2022-3328)","refsource":"FULLDISC","tags":[],"title":"Full Disclosure: Race condition in snap-confine's must_mkdir_and_open_with_perms() (CVE-2022-3328)","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"http://www.openwall.com/lists/oss-security/2022/11/30/2","name":"[oss-security] 20221130 Race condition in snap-confine's must_mkdir_and_open_with_perms() (CVE-2022-3328)","refsource":"MLIST","tags":[],"title":"oss-security - Race condition in snap-confine's must_mkdir_and_open_with_perms()\n (CVE-2022-3328)","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"http://packetstormsecurity.com/files/169611/Leeloo-Multipath-Authorization-Bypass-Symlink-Attack.html","name":"http://packetstormsecurity.com/files/169611/Leeloo-Multipath-Authorization-Bypass-Symlink-Attack.html","refsource":"MISC","tags":[],"title":"Leeloo Multipath Authorization Bypass / Symlink Attack ≈ Packet Storm","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"http://seclists.org/fulldisclosure/2022/Oct/25","name":"20221030 Authorization bypass and symlink attack in multipathd (CVE-2022-41974 and CVE-2022-41973)","refsource":"FULLDISC","tags":[],"title":"Full Disclosure: Authorization bypass and symlink attack in multipathd (CVE-2022-41974 and CVE-2022-41973)","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://lists.debian.org/debian-lts-announce/2022/12/msg00037.html","name":"[debian-lts-announce] 20221229 [SECURITY] [DLA 3250-1] multipath-tools security update","refsource":"MLIST","tags":[],"title":"[SECURITY] [DLA 3250-1] multipath-tools security update","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"http://www.openwall.com/lists/oss-security/2022/10/24/2","name":"http://www.openwall.com/lists/oss-security/2022/10/24/2","refsource":"MISC","tags":[],"title":"oss-security - Authorization bypass and symlink attack in multipathd (CVE-2022-41974\n and CVE-2022-41973)","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://security.gentoo.org/glsa/202311-06","name":"GLSA-202311-06","refsource":"","tags":[],"title":"multipath-tools: Multiple Vulnerabilities (GLSA 202311-06) — Gentoo security","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-41974","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-41974","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2022","cve_id":"41974","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"debian","cpe5":"debian_linux","cpe6":"10.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2022","cve_id":"41974","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"debian","cpe5":"debian_linux","cpe6":"11.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2022","cve_id":"41974","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"fedoraproject","cpe5":"fedora","cpe6":"36","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2022","cve_id":"41974","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"opensvc","cpe5":"multipath-tools","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[{"cve":"CVE-2022-41974","qid":"160167","title":"Oracle Enterprise Linux Security Update for device-mapper-multipath (ELSA-2022-7186)"},{"cve":"CVE-2022-41974","qid":"160174","title":"Oracle Enterprise Linux Security Update for device-mapper-multipath (ELSA-2022-7192)"},{"cve":"CVE-2022-41974","qid":"160178","title":"Oracle Enterprise Linux Security Update for device-mapper-multipath (ELSA-2022-7185)"},{"cve":"CVE-2022-41974","qid":"181449","title":"Debian Security Update for multipath-tools (DLA 3250-1)"},{"cve":"CVE-2022-41974","qid":"181659","title":"Debian Security Update for multipath-tools (DSA 5366-1)"},{"cve":"CVE-2022-41974","qid":"184918","title":"Debian Security Update for multipath-tools (CVE-2022-41974)"},{"cve":"CVE-2022-41974","qid":"199001","title":"Authorization bypass and symlink attack in multipathd (Leeloo Multipath)"},{"cve":"CVE-2022-41974","qid":"199033","title":"Ubuntu Security Notification for multipath-tools Vulnerabilities (USN-5731-1)"},{"cve":"CVE-2022-41974","qid":"240785","title":"Red Hat Update for device-mapper-multipath (RHSA-2022:7186)"},{"cve":"CVE-2022-41974","qid":"240788","title":"Red Hat Update for device-mapper-multipath (RHSA-2022:7185)"},{"cve":"CVE-2022-41974","qid":"240789","title":"Red Hat Update for device-mapper-multipath (RHSA-2022:7188)"},{"cve":"CVE-2022-41974","qid":"240790","title":"Red Hat Update for device-mapper-multipath (RHSA-2022:7192)"},{"cve":"CVE-2022-41974","qid":"240793","title":"Red Hat Update for device-mapper-multipath (RHSA-2022:7191)"},{"cve":"CVE-2022-41974","qid":"257206","title":"CentOS Security Update for device-mapper-multipath Security Update (CESA-2022:7186)"},{"cve":"CVE-2022-41974","qid":"283303","title":"Fedora Security Update for device (FEDORA-2022-6ec78b2586)"},{"cve":"CVE-2022-41974","qid":"354137","title":"Amazon Linux Security Advisory for device-mapper-multipath : ALAS2-2022-1883"},{"cve":"CVE-2022-41974","qid":"355168","title":"Amazon Linux Security Advisory for device-mapper-multipath : ALAS2023-2023-126"},{"cve":"CVE-2022-41974","qid":"355243","title":"Amazon Linux Security Advisory for device-mapper-multipath : ALAS2023-2023-141"},{"cve":"CVE-2022-41974","qid":"377742","title":"Alibaba Cloud Linux Security Update for device-mapper-multipath (ALINUX2-SA-2022:0050)"},{"cve":"CVE-2022-41974","qid":"377748","title":"Alibaba Cloud Linux Security Update for device-mapper-multipath (ALINUX3-SA-2022:0177)"},{"cve":"CVE-2022-41974","qid":"672593","title":"EulerOS Security Update for device-mapper-multipath (EulerOS-SA-2023-1310)"},{"cve":"CVE-2022-41974","qid":"672649","title":"EulerOS Security Update for multipath-tools (EulerOS-SA-2023-1394)"},{"cve":"CVE-2022-41974","qid":"672654","title":"EulerOS Security Update for multipath-tools (EulerOS-SA-2023-1366)"},{"cve":"CVE-2022-41974","qid":"672682","title":"EulerOS Security Update for multipath-tools (EulerOS-SA-2023-1428)"},{"cve":"CVE-2022-41974","qid":"672686","title":"EulerOS Security Update for multipath-tools (EulerOS-SA-2023-1413)"},{"cve":"CVE-2022-41974","qid":"672720","title":"EulerOS Security Update for multipath-tools (EulerOS-SA-2023-1452)"},{"cve":"CVE-2022-41974","qid":"672723","title":"EulerOS Security Update for multipath-tools (EulerOS-SA-2023-1477)"},{"cve":"CVE-2022-41974","qid":"673061","title":"EulerOS Security Update for device-mapper-multipath (EulerOS-SA-2023-2140)"},{"cve":"CVE-2022-41974","qid":"710790","title":"Gentoo Linux multipath-tools Multiple Vulnerabilities (GLSA 202311-06)"},{"cve":"CVE-2022-41974","qid":"752703","title":"SUSE Enterprise Linux Security Update for multipath-tools (SUSE-SU-2022:3707-1)"},{"cve":"CVE-2022-41974","qid":"752704","title":"SUSE Enterprise Linux Security Update for multipath-tools (SUSE-SU-2022:3713-1)"},{"cve":"CVE-2022-41974","qid":"752705","title":"SUSE Enterprise Linux Security Update for multipath-tools (SUSE-SU-2022:3712-1)"},{"cve":"CVE-2022-41974","qid":"752706","title":"SUSE Enterprise Linux Security Update for multipath-tools (SUSE-SU-2022:3711-1)"},{"cve":"CVE-2022-41974","qid":"752707","title":"SUSE Enterprise Linux Security Update for multipath-tools (SUSE-SU-2022:3710-1)"},{"cve":"CVE-2022-41974","qid":"752709","title":"SUSE Enterprise Linux Security Update for multipath-tools (SUSE-SU-2022:3709-1)"},{"cve":"CVE-2022-41974","qid":"752711","title":"SUSE Enterprise Linux Security Update for multipath-tools (SUSE-SU-2022:3708-1)"},{"cve":"CVE-2022-41974","qid":"904435","title":"Common Base Linux Mariner (CBL-Mariner) Security Update for device-mapper-multipath (11414)"},{"cve":"CVE-2022-41974","qid":"904473","title":"Common Base Linux Mariner (CBL-Mariner) Security Update for device-mapper-multipath (11373)"},{"cve":"CVE-2022-41974","qid":"905241","title":"Common Base Linux Mariner (CBL-Mariner) Security Update for device-mapper-multipath (11373-1)"},{"cve":"CVE-2022-41974","qid":"940707","title":"AlmaLinux Security Update for device-mapper-multipath (ALSA-2022:7192)"},{"cve":"CVE-2022-41974","qid":"940713","title":"AlmaLinux Security Update for device-mapper-multipath (ALSA-2022:7185)"},{"cve":"CVE-2022-41974","qid":"960200","title":"Rocky Linux Security Update for device-mapper-multipath (RLSA-2022:7192)"},{"cve":"CVE-2022-41974","qid":"960501","title":"Rocky Linux Security Update for device-mapper-multipath (RLSA-2022:7185)"}]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2022-41974","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"multipath-tools 0.7.0 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited alone or in conjunction with CVE-2022-41973. Local users able to write to UNIX domain sockets can bypass access controls and manipulate the multipath setup. This can lead to local privilege escalation to root. This occurs because an attacker can repeat a keyword, which is mishandled because arithmetic ADD is used instead of bitwise OR."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"url":"https://bugzilla.suse.com/show_bug.cgi?id=1202739","refsource":"MISC","name":"https://bugzilla.suse.com/show_bug.cgi?id=1202739"},{"refsource":"MISC","name":"https://github.com/opensvc/multipath-tools/releases/tag/0.9.2","url":"https://github.com/opensvc/multipath-tools/releases/tag/0.9.2"},{"refsource":"MISC","name":"http://www.openwall.com/lists/oss-security/2022/10/24/2","url":"http://www.openwall.com/lists/oss-security/2022/10/24/2"},{"refsource":"FULLDISC","name":"20221030 Authorization bypass and symlink attack in multipathd (CVE-2022-41974 and CVE-2022-41973)","url":"http://seclists.org/fulldisclosure/2022/Oct/25"},{"refsource":"MISC","name":"http://packetstormsecurity.com/files/169611/Leeloo-Multipath-Authorization-Bypass-Symlink-Attack.html","url":"http://packetstormsecurity.com/files/169611/Leeloo-Multipath-Authorization-Bypass-Symlink-Attack.html"},{"refsource":"FEDORA","name":"FEDORA-2022-6ec78b2586","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QIGZM5NOOMFDCITOLQEJNNX5SCRQLQVV/"},{"refsource":"MISC","name":"https://www.qualys.com/2022/10/24/leeloo-multipath/leeloo-multipath.txt","url":"https://www.qualys.com/2022/10/24/leeloo-multipath/leeloo-multipath.txt"},{"refsource":"MLIST","name":"[oss-security] 20221130 Race condition in snap-confine's must_mkdir_and_open_with_perms() (CVE-2022-3328)","url":"http://www.openwall.com/lists/oss-security/2022/11/30/2"},{"refsource":"FULLDISC","name":"20221208 Race condition in snap-confine's must_mkdir_and_open_with_perms() (CVE-2022-3328)","url":"http://seclists.org/fulldisclosure/2022/Dec/4"},{"refsource":"MISC","name":"http://packetstormsecurity.com/files/170176/snap-confine-must_mkdir_and_open_with_perms-Race-Condition.html","url":"http://packetstormsecurity.com/files/170176/snap-confine-must_mkdir_and_open_with_perms-Race-Condition.html"},{"refsource":"MLIST","name":"[debian-lts-announce] 20221229 [SECURITY] [DLA 3250-1] multipath-tools security update","url":"https://lists.debian.org/debian-lts-announce/2022/12/msg00037.html"},{"refsource":"DEBIAN","name":"DSA-5366","url":"https://www.debian.org/security/2023/dsa-5366"}]}},"nvd":{"publishedDate":"2022-10-29 19:15:00","lastModifiedDate":"2023-11-25 09:15:00","problem_types":["CWE-269"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:opensvc:multipath-tools:*:*:*:*:*:*:*:*","versionStartIncluding":"0.7.0","versionEndExcluding":"0.9.2","cpe_name":[]}]},{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*","cpe_name":[]}]},{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":null,"notes":[]}}}