CVE-2022-41974 is a local privilege escalation vulnerability in multipath-tools versions 0.7.0 through 0.9.1, affecting various Linux distributions including Debian and Fedora. A local attacker with write access to UNIX domain sockets can bypass access controls and manipulate multipath setup, leading to root access. This vulnerability has a CVSS score of 7.8 (High) due to its low attack complexity and high impact on confidentiality, integrity, and availability. While not listed in CISA's KEV catalog, it has been publicly discussed and covered by security media, with one article detailing how it can be chained with other vulnerabilities for full root compromise. No public exploit code or Metasploit/Nuclei modules are currently available.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 0.7.0, < 0.9.2CPE matchmatch criteria | cpe:2.3:a:opensvc:multipath-tools:*:*:*:*:*:*:*:* | ||
36CPE matchmatch criteria | cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* | ||
10.0CPE matchmatch criteria | cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | ||
11.0CPE matchmatch criteria | cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
CVE-2022-41974
Nov 8, 2022device-mapper-multipath: Authorization bypass, multipathd daemon listens for client connections on an abstract Unix socket
Oct 24, 2022multipath-tools 0.7.0 through 0.9.x before 0.9.2 allows local users to obtain root access as exploited alone or in conjunction with CVE-2022-41973. Local users able to write to UNIX domain sockets can bypass access controls and manipulate the multipath setup. This can lead to local privilege escalation to root. This occurs because an attacker can repeat a keyword which is mishandled because arithmetic ADD is used instead of bitwise OR.
Oct 11, 2022