Insecure Handling of Files in device-mapper-multipath
Summary
ALSA-2023:2459: Moderate: device-mapper-multipath security and bug fix update. Affects device-mapper-multipath versions < 0.8.7-20.el9. Fixed in 0.8.7-20.el9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
device-mapper-multipath is a package that provides tools for managing multipath devices using the device-mapper multipath kernel module. It is commonly used in AlmaLinux 9. Multipath devices are used to provide redundancy and load balancing in storage systems. The device-mapper-multipath package includes the multipathd daemon, which is responsible for managing multipath devices.
The vulnerability in device-mapper-multipath (CVE-2022-41973) is related to insecure handling of files in the /dev/shm directory. This vulnerability can be exploited through a symlink attack, potentially leading to unauthorized access or privilege escalation.
Vulnerability Detail
The vulnerability (CVE-2022-41973) in device-mapper-multipath is caused by insecure handling of files in the /dev/shm directory. By creating a symbolic link to a sensitive file, an attacker can trick the multipathd daemon into overwriting or reading unintended files, potentially leading to unauthorized access or privilege escalation. This vulnerability has a moderate severity rating.
To exploit this vulnerability, an attacker would need local access to the system and the ability to create symbolic links in the /dev/shm directory. The impact of this vulnerability depends on the specific files that are targeted and the privileges of the multipathd daemon.
How To Fix
Minimum fixed version
0.8.7-20.el9
This is the first release that contains the fix.
sudo dnf update device-mapper-multipathTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by updating the device-mapper-multipath package to the latest version.
Conclusion
The device-mapper-multipath package in AlmaLinux 9 is vulnerable to an insecure handling of files in the /dev/shm directory, which can be exploited through a symlink attack. To mitigate this vulnerability, it is recommended to update the device-mapper-multipath package to version 0.8.7-20.el9 or later. This update includes a fix for the vulnerability. If you need further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for device-mapper-multipath →
FAQ
device-mapper-multipath is a package that provides tools for managing multipath devices using the device-mapper multipath kernel module. It is commonly used in AlmaLinux 9.
The impact of this vulnerability depends on the specific files that are targeted and the privileges of the multipathd daemon. It could potentially lead to unauthorized access or privilege escalation.
To fix this vulnerability, update the device-mapper-multipath package to version 0.8.7-20.el9 or later. This update includes a fix for the insecure handling of files in the /dev/shm directory.
There is no known workaround for this vulnerability. It is recommended to apply the fix by updating the device-mapper-multipath package to the latest version.
No, this vulnerability requires local access to the system and the ability to create symbolic links in the /dev/shm directory.
Related vulnerabilities
Recent vulnerabilities recorded for device-mapper-multipath.
