Authorization Bypass in device-mapper-multipath
Summary
ALSA-2022:7192: Important: device-mapper-multipath security update. Affects device-mapper-multipath versions < 0.8.4-22.el8_6.2. Fixed in 0.8.4-22.el8_6.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The device-mapper-multipath package provides tools for managing multipath devices using the device-mapper multipath kernel module. It allows for the configuration and management of multiple paths between storage devices and their corresponding logical devices. This package is commonly used in Linux systems to improve storage reliability and performance.
The vulnerability identified as CVE-2022-41974 affects the device-mapper-multipath package. It allows for an authorization bypass, where the multipathd daemon listens for client connections on an abstract Unix socket. This vulnerability can potentially be exploited by an attacker to gain unauthorized access to the multipathd daemon, leading to various security risks and potential system compromise.
Vulnerability Detail
The vulnerability (CVE-2022-41974) in device-mapper-multipath allows for an authorization bypass. The multipathd daemon, responsible for managing multipath devices, listens for client connections on an abstract Unix socket. By exploiting this vulnerability, an attacker can bypass the authorization mechanism and gain unauthorized access to the daemon. This can lead to various security issues, including unauthorized control over multipath devices, potential data manipulation or theft, and potential system compromise.
The impact of this vulnerability is significant, as it provides an entry point for attackers to compromise the integrity and security of the affected system.
How To Fix
Minimum fixed version
0.8.4-22.el8_6.2
This is the first release that contains the fix.
sudo dnf update device-mapper-multipathTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The authorization bypass vulnerability in device-mapper-multipath (CVE-2022-41974) poses a significant security risk to affected systems. It is crucial to update the package to version 0.8.4-22.el8_6.2 or later to address this vulnerability and protect the integrity and security of the system. Failure to apply the necessary security patches may result in unauthorized access, data manipulation or theft, and potential system compromise. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for device-mapper-multipath →
FAQ
Device-mapper-multipath is a package that provides tools for managing multipath devices in Linux systems. It allows for the configuration and management of multiple paths between storage devices and their corresponding logical devices, improving storage reliability and performance.
The vulnerability (CVE-2022-41974) allows for an authorization bypass in the device-mapper-multipath package. It can be exploited by attackers to gain unauthorized access to the multipathd daemon, potentially leading to unauthorized control over multipath devices, data manipulation or theft, and system compromise.
To fix this vulnerability, update the device-mapper-multipath package to version 0.8.4-22.el8_6.2 or later. This update includes the necessary security patches to address the authorization bypass vulnerability (CVE-2022-41974).
The update for device-mapper-multipath can be obtained from the official AlmaLinux repositories or through the package manager of the respective Linux distribution.
No specific workaround has been provided for this vulnerability. It is recommended to apply the security update as soon as possible to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for device-mapper-multipath.
