Improper Authorization in multipath-tools - CVE-2022-41974

Vulnerability identifier: #VU68722

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-41974

CWE-ID: CWE-285

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to incorrectly implemented authorization process within multipathd daemon. A local unprivileged user can bypass build-in authorization and execute privileged commands on the system.

multipath-tools
PowerStore T
EMC ECS
EMC Cloud Tiering Appliance
Amazon Linux AMI
Gentoo Linux
Oracle Linux
Debian Linux
SUSE CaaS Platform
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Linux Enterprise Micro
openSUSE Leap Micro
SUSE Enterprise Storage
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux Server
Anolis OS
CentOS
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux Workstation
SUSE Linux Enterprise Storage
Red Hat CodeReady Linux Builder for IBM z Systems
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat CodeReady Linux Builder for x86_64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for ARM 64
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support
Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support
Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support
Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support
SUSE OpenStack Cloud Crowbar
SUSE OpenStack Cloud
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Software Development Kit
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise Desktop
openSUSE Leap
Ubuntu
openEuler
Fedora
Red Hat Advanced Cluster Management for Kubernetes
Session Smart Router
Contrail Cloud
Red Hat OpenShift Container Platform
Dell EMC Container Storage Modules
OpenShift Virtualization
IBM Qradar SIEM
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
libdmmp-devel
libdmmp
kpartx
device-mapper-multipath-sysvinit
device-mapper-multipath-libs
device-mapper-multipath-devel
device-mapper-multipath
device-mapper-multipath (Red Hat package)
multipath-tools-debugsource
multipath-tools-debuginfo
multipath-tools
kpartx-debuginfo
libdmmp0_1_0
libdmmp0_1_0-debuginfo
multipath-tools-rbd
multipath-tools-rbd-debuginfo
multipath-tools-devel
multipath-tools (Ubuntu package)
libdmmp0_2_0-debuginfo
libdmmp0_2_0
multipath-tools-help
multipath-tools (Debian package)
libmpath0
libmpath0-debuginfo
sys-fs/multipath-tools
redhat-virtualization-host-productimg (Red Hat package)
redhat-release-virtualization-host (Red Hat package)
IBM Security Guardium
Juniper Junos Space

Install updates from vendor's website.

multipath-tools - update to 0.9.2
Red Hat Advanced Cluster Management for Kubernetes - update to 2.4.8
Red Hat OpenShift Container Platform - addressed in versions 4.8.53, 4.11.12
OpenShift Virtualization - update to 4.9.7
IBM Qradar SIEM - addressed in versions 7.4.3 Fix Pack 8, 7.5.0 Update Pack 4
libdmmp-devel - update to 0.4.9-136
libdmmp - addressed in versions 0.4.9-136, 0.8.4-22.0.1, 0.8.4-37.0.1
kpartx - addressed in versions 0.4.9-136, 0.8.4-22.0.1, 0.8.4-37.0.1
device-mapper-multipath-sysvinit - update to 0.4.9-136
device-mapper-multipath-libs - addressed in versions 0.4.9-136, 0.8.4-22.0.1, 0.8.4-37.0.1
device-mapper-multipath-devel - addressed in versions 0.4.9-136, 0.8.4-37.0.1
device-mapper-multipath - addressed in versions 0.4.9-136, 0.8.4-22.0.1, 0.8.4-37.0.1
device-mapper-multipath (Red Hat package) - addressed in versions 0.4.9-136.el7_9, 0.8.0-5.el8_1.1, 0.8.3-3.el8_2.7, 0.8.4-10.el8_4.4, 0.8.4-22.el8_6.2, 0.8.4-28.el8_7.1, 0.8.7-7.el9_0.1, 0.8.7-12.el9_1.1
multipath-tools-debugsource - addressed in versions 0.6.2+suse20221017.514d453-71.26.1, 0.7.1+125+suse.c18e287-2.23.1, 0.7.3+173+suse.7dd1b01-150000.3.29.1, 0.7.3+177+suse.b16d5dc-2.23.1, 0.7.9+232+suse.cbc3754-3.14.1, 0.7.9+232+suse.cbc3754-150100.3.20.1, 0.8.2+182.6d41865-150200.4.14.1, 0.8.5+126+suse.8ce8da5-150300.2.14.1, 0.9.0+62+suse.3e048d4-150400.4.7.1
multipath-tools-debuginfo - addressed in versions 0.6.2+suse20221017.514d453-71.26.1, 0.7.1+125+suse.c18e287-2.23.1, 0.7.3+173+suse.7dd1b01-150000.3.29.1, 0.7.3+177+suse.b16d5dc-2.23.1, 0.7.9+232+suse.cbc3754-3.14.1, 0.7.9+232+suse.cbc3754-150100.3.20.1, 0.8.2+182.6d41865-150200.4.14.1, 0.8.5+126+suse.8ce8da5-150300.2.14.1, 0.9.0+62+suse.3e048d4-150400.4.7.1
multipath-tools - addressed in versions 0.6.2+suse20221017.514d453-71.26.1, 0.7.1+125+suse.c18e287-2.23.1, 0.7.3+173+suse.7dd1b01-150000.3.29.1, 0.7.3+177+suse.b16d5dc-2.23.1, 0.7.9+232+suse.cbc3754-3.14.1, 0.7.9+232+suse.cbc3754-150100.3.20.1, 0.8.2+182.6d41865-150200.4.14.1, 0.8.5+126+suse.8ce8da5-150300.2.14.1, 0.9.0+62+suse.3e048d4-150400.4.7.1
kpartx-debuginfo - addressed in versions 0.6.2+suse20221017.514d453-71.26.1, 0.7.1+125+suse.c18e287-2.23.1, 0.7.3+173+suse.7dd1b01-150000.3.29.1, 0.7.3+177+suse.b16d5dc-2.23.1, 0.7.9+232+suse.cbc3754-3.14.1, 0.7.9+232+suse.cbc3754-150100.3.20.1, 0.8.2+182.6d41865-150200.4.14.1, 0.8.5+126+suse.8ce8da5-150300.2.14.1, 0.9.0+62+suse.3e048d4-150400.4.7.1
kpartx - addressed in versions 0.6.2+suse20221017.514d453-71.26.1, 0.7.1+125+suse.c18e287-2.23.1, 0.7.3+173+suse.7dd1b01-150000.3.29.1, 0.7.3+177+suse.b16d5dc-2.23.1, 0.7.9+232+suse.cbc3754-3.14.1, 0.7.9+232+suse.cbc3754-150100.3.20.1, 0.8.2+182.6d41865-150200.4.14.1, 0.8.5+126+suse.8ce8da5-150300.2.14.1, 0.9.0+62+suse.3e048d4-150400.4.7.1
libdmmp0_1_0 - update to 0.7.3+173+suse.7dd1b01-150000.3.29.1
libdmmp0_1_0-debuginfo - update to 0.7.3+173+suse.7dd1b01-150000.3.29.1
multipath-tools-rbd - update to 0.7.3+173+suse.7dd1b01-150000.3.29.1
multipath-tools-rbd-debuginfo - update to 0.7.3+173+suse.7dd1b01-150000.3.29.1
libdmmp-devel - addressed in versions 0.7.3+173+suse.7dd1b01-150000.3.29.1, 0.7.9+232+suse.cbc3754-150100.3.20.1, 0.8.2+182.6d41865-150200.4.14.1, 0.8.5+126+suse.8ce8da5-150300.2.14.1, 0.9.0+62+suse.3e048d4-150400.4.7.1
multipath-tools-devel - addressed in versions 0.7.3+173+suse.7dd1b01-150000.3.29.1, 0.7.9+232+suse.cbc3754-3.14.1, 0.7.9+232+suse.cbc3754-150100.3.20.1, 0.8.2+182.6d41865-150200.4.14.1, 0.8.5+126+suse.8ce8da5-150300.2.14.1, 0.9.0+62+suse.3e048d4-150400.4.7.1
multipath-tools (Ubuntu package) - addressed in versions 0.7.4-2ubuntu3.2, 0.8.3-1ubuntu2.1, 0.8.8-1ubuntu1.22.04.1, 0.8.8-1ubuntu1.22.10.1
libdmmp0_2_0-debuginfo - addressed in versions 0.7.9+232+suse.cbc3754-150100.3.20.1, 0.8.2+182.6d41865-150200.4.14.1, 0.8.5+126+suse.8ce8da5-150300.2.14.1, 0.9.0+62+suse.3e048d4-150400.4.7.1
libdmmp0_2_0 - addressed in versions 0.7.9+232+suse.cbc3754-150100.3.20.1, 0.8.2+182.6d41865-150200.4.14.1, 0.8.5+126+suse.8ce8da5-150300.2.14.1, 0.9.0+62+suse.3e048d4-150400.4.7.1
multipath-tools-devel - addressed in versions 0.8.4-16, 0.8.4-17
multipath-tools-debuginfo - addressed in versions 0.8.4-16, 0.8.4-17
multipath-tools - addressed in versions 0.8.4-16, 0.8.4-17
kpartx - addressed in versions 0.8.4-16, 0.8.4-17
multipath-tools-debugsource - addressed in versions 0.8.4-16, 0.8.4-17
multipath-tools-help - addressed in versions 0.8.4-16, 0.8.4-17
multipath-tools (Debian package) - update to 0.8.5-2+deb11u1
libmpath0 - addressed in versions 0.8.5+126+suse.8ce8da5-150300.2.14.1, 0.9.0+62+suse.3e048d4-150400.4.7.1
libmpath0-debuginfo - addressed in versions 0.8.5+126+suse.8ce8da5-150300.2.14.1, 0.9.0+62+suse.3e048d4-150400.4.7.1
device-mapper-multipath - update to 0.8.7-9.fc36
device-mapper-multipath - update to 0.8.7-16
sys-fs/multipath-tools - update to 0.9.3
Dell EMC Container Storage Modules - update to 1.5.0
PowerStore T - update to 3.5.0.1-2083289
EMC ECS - update to 3.8.0.2
redhat-virtualization-host-productimg (Red Hat package) - update to 4.5.3-1.el8
redhat-release-virtualization-host (Red Hat package) - update to 4.5.3-1.el8ev
Session Smart Router - addressed in versions 6.2.3-r2, 6.2.10, 6.3.7
EMC Cloud Tiering Appliance - update to 13.1.0.2.29
Contrail Cloud - update to 16.3.0
Juniper Junos Space - update to 23.1R1

• https://bugzilla.redhat.com/show_bug.cgi?id=2133988
• https://github.com/opensvc/multipath-tools/releases/tag/0.9.2
• https://seclists.org/fulldisclosure/2022/Oct/25

• Multiple vulnerabilities in multipath-tools multipathd daemon
• SUSE update for multipath-tools
• SUSE update for multipath-tools
• SUSE update for multipath-tools
• SUSE update for multipath-tools
• SUSE update for multipath-tools
• SUSE update for multipath-tools
• SUSE update for multipath-tools
• SUSE update for multipath-tools
• SUSE update for multipath-tools
• Red Hat Enterprise Linux 8 update for device-mapper-multipath
• Red Hat Enterprise Linux 9 update for device-mapper-multipath
• Red Hat Enterprise Linux 7 update for device-mapper-multipath
• Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions update for device-mapper-multipath
• Red Hat Enterprise Linux 8.2 Extended Update Support update for device-mapper-multipath
• Red Hat Enterprise Linux 8.4 Extended Update Support update for device-mapper-multipath
• Multiple vulnerabilities in Red Hat Advanced Cluster Management 2.4
• Multiple vulnerabilities in OpenShift Container Platform 4.11
• Red Hat Enterprise Linux 8 update for device-mapper-multipath
• Red Hat Enterprise Linux 9 update for device-mapper-multipath
• Ubuntu update for multipath-tools
• Multiple vulnerabilities in OpenShift Container Platform 4.8
• Multiple vulnerabilities in Red Hat Virtualization 4 for RHEL 8
• Multiple vulnerabilties in Red Hat OpenShift Virtualization
• CentOS 7 update for device-mapper-multipath
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in Dell Cloud Tiering Appliance
• Debian update for multipath-tools
• Multiple vulnerabilities in Dell ECS
• Multiple vulnerabilities in IBM Security Guardium
• Multiple vulnerabilities in Juniper Networks Contrail Cloud
• Multiple vulnerabilities in Juniper Junos Space
• Multiple vulnerabilities in Oracle Linux
• Improper authorization in Dell Container Storage Modules
• Multiple vulnerabilities in Dell PowerStore Family
• Gentoo update for multipath-tools
• Multiple vulnerabilities in Juniper Networks Session Smart Router
• openEuler update for multipath-tools
• openEuler update for multipath-tools
• Amazon Linux AMI update for device-mapper-multipath
• Amazon Linux AMI update for device-mapper-multipath
• Fedora 36 update for device-mapper-multipath
• Anolis OS update for device-mapper-multipath
• Anolis OS update for device-mapper-multipath
• Anolis OS update for device-mapper-multipath
• Juniper Session Smart Router update for third-party components