multipath-tools 0.7.7 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited in conjunction with CVE-2022-41974. Local users able to access /dev/shm can change symlinks in multipathd due to incorrect symlink handling, which could lead to controlled file writes outside of the /dev/shm directory. This could be used indirectly for local privilege escalation to root.
Attack Parameters
Attack Vector
Local
Requires local access
Attack Complexity
Low
Easy to exploit
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
High
Complete denial of service
CVSS Vector v3.1
Weakness Type (CWE)
Vulnerable Products 3
| Configuration | From (including) | Up to (excluding) |
|---|---|---|
|
Opensvc Multipath-Tools
cpe:2.3:a:opensvc:multipath-tools:*:*:*:*:*:*:*:*
|
0.7.7
|
0.9.2
|
|
Fedoraproject Fedora
cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*
|
— | — |
|
Debian Debian_Linux
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
|
— | — |
References 13
http://packetstormsecurity.com/files/169611/Leeloo-Multipath-Authorization-Bypa…
cve@mitre.org
http://packetstormsecurity.com/files/170176/snap-confine-must_mkdir_and_open_wi…
cve@mitre.org
http://seclists.org/fulldisclosure/2022/Dec/4
cve@mitre.org
http://seclists.org/fulldisclosure/2022/Oct/25
cve@mitre.org
http://www.openwall.com/lists/oss-security/2022/10/24/2
cve@mitre.org
http://www.openwall.com/lists/oss-security/2022/11/30/2
cve@mitre.org
https://bugzilla.suse.com/show_bug.cgi?id=1202739
cve@mitre.org
https://github.com/opensvc/multipath-tools/releases/tag/0.9.2
cve@mitre.org
https://lists.debian.org/debian-lts-announce/2022/12/msg00037.html
cve@mitre.org
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapr…
cve@mitre.org
https://security.gentoo.org/glsa/202311-06
cve@mitre.org
https://www.debian.org/security/2023/dsa-5366
cve@mitre.org
https://www.qualys.com/2022/10/24/leeloo-multipath/leeloo-multipath.txt
cve@mitre.org