What’s Vulnerable › Vulnerabilities

CVE-2022-41974

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-10-29 · updated 2026-06-17
• Weakness: CWE-269

Description

multipath-tools 0.7.0 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited alone or in conjunction with CVE-2022-41973. Local users able to write to UNIX domain sockets can bypass access controls and manipulate the multipath setup. This can lead to local privilege escalation to root. This occurs because an attacker can repeat a keyword, which is mishandled because arithmetic ADD is used instead of bitwise OR.

Affected products

• Debian Linux: 10.0, 11.0
• Fedoraproject Fedora: 36
• Opensvc Multipath-Tools: from 0.7.0 before 0.9.2 — fixed in 0.9.2

How to fix

Upgrade to a fixed version: Opensvc Multipath-Tools 0.9.2. Check the vendor advisory for mitigations.

References

• http://packetstormsecurity.com/files/169611/Leeloo-Multipath-Authorization-Bypass-Symlink-Attack.html
• http://packetstormsecurity.com/files/170176/snap-confine-must_mkdir_and_open_with_perms-Race-Condition.html
• http://seclists.org/fulldisclosure/2022/Dec/4
• http://seclists.org/fulldisclosure/2022/Oct/25
• http://www.openwall.com/lists/oss-security/2022/10/24/2
• http://www.openwall.com/lists/oss-security/2022/11/30/2
• https://bugzilla.suse.com/show_bug.cgi?id=1202739
• https://github.com/opensvc/multipath-tools/releases/tag/0.9.2
• https://lists.debian.org/debian-lts-announce/2022/12/msg00037.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QIGZM5NOOMFDCITOLQEJNNX5SCRQLQVV/
• https://security.gentoo.org/glsa/202311-06
• https://www.debian.org/security/2023/dsa-5366

Get alerted when CVE-2022-41974 or the next vulnerability affects your stack