7.8

CVE-2022-41974

Exploit
multipath-tools 0.7.0 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited alone or in conjunction with CVE-2022-41973. Local users able to write to UNIX domain sockets can bypass access controls and manipulate the multipath setup. This can lead to local privilege escalation to root. This occurs because an attacker can repeat a keyword, which is mishandled because arithmetic ADD is used instead of bitwise OR.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Opensvc ≫ Multipath-tools Version >= 0.7.0 < 0.9.2
Fedoraproject ≫ Fedora Version 36
Debian ≫ Debian Linux Version 10.0
Debian ≫ Debian Linux Version 11.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.62% 0.466
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-269 Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

http://packetstormsecurity.com/files/170176/snap-confine-must_mkdir_and_open_with_perms-Race-Condition.html
Third Party Advisory
Exploit
VDB Entry
http://seclists.org/fulldisclosure/2022/Dec/4
Third Party Advisory
Exploit
Mailing List
http://www.openwall.com/lists/oss-security/2022/11/30/2
Third Party Advisory
Exploit
Mailing List
http://packetstormsecurity.com/files/169611/Leeloo-Multipath-Authorization-Bypass-Symlink-Attack.html
Third Party Advisory
Exploit
VDB Entry
Mailing List
http://seclists.org/fulldisclosure/2022/Oct/25
Third Party Advisory
Exploit
Mailing List
http://www.openwall.com/lists/oss-security/2022/10/24/2
Third Party Advisory
Exploit
Mailing List
https://bugzilla.suse.com/show_bug.cgi?id=1202739
Third Party Advisory
Issue Tracking
https://github.com/opensvc/multipath-tools/releases/tag/0.9.2
Third Party Advisory
Release Notes
https://lists.debian.org/debian-lts-announce/2022/12/msg00037.html
Third Party Advisory
Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QIGZM5NOOMFDCITOLQEJNNX5SCRQLQVV/
https://security.gentoo.org/glsa/202311-06
https://www.debian.org/security/2023/dsa-5366
Third Party Advisory
https://www.qualys.com/2022/10/24/leeloo-multipath/leeloo-multipath.txt
Third Party Advisory
Exploit