QID 199001

QID 199001: Authorization bypass and symlink attack in multipathd (Leeloo Multipath)

The authorization bypass (CVE-2022-41974) was introduced in February 2017 (version 0.7.0) by commit 9acda0c ("Perform socket client uid check on IPC commands"), but earlier versions perform no authorization checks at all: any unprivileged local user can issue any privileged command to multipathd. The symlink attack (CVE-2022-41973) was introduced in May 2018 (version.7.7) by commit 65d0a63 ("functions to indicate mapping failure in /dev/shm"); the vulnerable code was hardened significantly in May 2020 (version 0.8.5) by commit 40ee3ea ("simplify failed wwid code"), but it remains exploitable nonetheless.

Attackers can exploit these flaw to bypass multipathd's authorization check.

CVSS V3 rated as High - 7.8 severity.

CVSS V2 rated as High - 6.8 severity.

Solution

Update to latest version.
Leeloo Multipath for affected packages and patching details.

Vendor References

Leeloo Multipath - www.qualys.com/2022/10/24/leeloo-multipath/leeloo-multipath.txt

CVEs related to QID 199001

CVE-2022-41974 | CVE-2022-41973 |

Software Advisories

Advisory ID	Software	Component	Link
41973	Ubuntu		github.com/opensvc/multipath-tools/commit/c4912a639b7ff527aa11d665944594926ff94a7a

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].