CVE-2022-41974

2022-10-2400:00:00

ubuntu.com

cve-2022-41974

multipath-tools

local privilege escalation

bypass access controls

unix domain sockets

root access

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

0.0004 Low

EPSS

Percentile

10.1%

JSON

multipath-tools 0.7.0 through 0.9.x before 0.9.2 allows local users to
obtain root access, as exploited alone or in conjunction with
CVE-2022-41973. Local users able to write to UNIX domain sockets can bypass
access controls and manipulate the multipath setup. This can lead to local
privilege escalation to root. This occurs because an attacker can repeat a
keyword, which is mishandled because arithmetic ADD is used instead of
bitwise OR.

Bugs

<https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1022742>

Notes

Author	Note
alexmurray	introduced in version 0.7.0 via commit 9acda0c but earlier versions do no authorization checks at all and are then technically also vulnerable
rodrigo-zaiden	earlier versions are not getting a code fix for this and applying one without upstream support does not seem feasible and can add too much risks.

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchmultipath-tools< 0.7.4-2ubuntu3.2UNKNOWN
ubuntu20.04noarchmultipath-tools< 0.8.3-1ubuntu2.1UNKNOWN
ubuntu22.04noarchmultipath-tools< 0.8.8-1ubuntu1.22.04.1UNKNOWN
ubuntu22.10noarchmultipath-tools< 0.8.8-1ubuntu1.22.10.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	multipath-tools	< 0.7.4-2ubuntu3.2	UNKNOWN
ubuntu	20.04	noarch	multipath-tools	< 0.8.3-1ubuntu2.1	UNKNOWN
ubuntu	22.04	noarch	multipath-tools	< 0.8.8-1ubuntu1.22.04.1	UNKNOWN
ubuntu	22.10	noarch	multipath-tools	< 0.8.8-1ubuntu1.22.10.1	UNKNOWN