Description
multipath-tools 0.7.7 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited in conjunction with CVE-2022-41974. Local users able to access /dev/shm can change symlinks in multipathd due to incorrect symlink handling, which could lead to controlled file writes outside of the /dev/shm directory. This could be used indirectly for local privilege escalation to root.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | multipath-tools | 0.9.4-1 | — |
| Debian 13 | multipath-tools | 0.9.4-1 | — |
| Debian 12 | multipath-tools | 0.9.4-1 | — |
| Debian 11 | multipath-tools | 0.8.5-2+deb11u1 | DSA-5366-1 |
| Debian 10 | multipath-tools | 0.7.9-3+deb10u2 | DLA-3250-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | multipath-tools | 0.8.8-1ubuntu1.22.04.1 | USN-5731-1 |
| Ubuntu 20.04 LTS | multipath-tools | 0.8.3-1ubuntu2.1 | USN-5731-1 |
| Ubuntu 18.04 LTS | multipath-tools | 0.7.4-2ubuntu3.2 | USN-5731-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | kpartx +3 | 0.8.7-20.el9 | RHSA-2023:2459 |
| RHEL 8 | kpartx +4 | 0.8.4-37.el8 | RHSA-2023:2948 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8.6 EUS | kpartx +4 | 0.8.4-22.el8_6.5 | RHSA-2024:1110 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | kpartx +3 | 0.8.7-20.el9 | ALSA-2023:2459 |
| AlmaLinux 8 | kpartx +4 | 0.8.4-37.el8 | ALSA-2023:2948 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP4 | multipath-tools | 0.9.0+62+suse.3e048d4-150400.4.7.1 | SUSE-SU-2022:3711-1 |
| SLES 15 SP3 | multipath-tools | 0.8.5+126+suse.8ce8da5-150300.2.14.1 | SUSE-SU-2022:3710-1 |
| SLES 15 SP2 | multipath-tools | 0.8.2+182.6d41865-150200.4.14.1 | SUSE-SU-2022:3709-1 |
| SLES 15 SP1 | multipath-tools | 0.7.9+232+suse.cbc3754-150100.3.20.1 | SUSE-SU-2022:3708-1 |
| SLES 12 SP5 | multipath-tools | 0.7.9+232+suse.cbc3754-3.14.1 | SUSE-SU-2022:3707-1 |
Show 13 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP2 | multipath-tools | 0.8.2+182.6d41865-150200.4.14.1 | SUSE-SU-2022:3709-1 |
| SLES for SAP 15 SP1 | multipath-tools | 0.7.9+232+suse.cbc3754-150100.3.20.1 | SUSE-SU-2022:3708-1 |
| SLES for SAP 12 SP5 | multipath-tools | 0.7.9+232+suse.cbc3754-3.14.1 | SUSE-SU-2022:3707-1 |
| SLE Micro 5.3 | multipath-tools | 0.9.0+62+suse.3e048d4-150400.4.7.1 | SUSE-SU-2022:3711-1 |
| SLE Micro 5.2 | multipath-tools | 0.8.5+126+suse.8ce8da5-150300.2.14.1 | SUSE-SU-2022:3710-1 |
| SLE Micro 5.1 | multipath-tools | 0.8.5+126+suse.8ce8da5-150300.2.14.1 | SUSE-SU-2022:3710-1 |
| SLE HPC 15 SP2 | multipath-tools | 0.8.2+182.6d41865-150200.4.14.1 | SUSE-SU-2022:3709-1 |
| SLE HPC 15 SP1 | multipath-tools | 0.7.9+232+suse.cbc3754-150100.3.20.1 | SUSE-SU-2022:3708-1 |
| SUSE Manager Server 4.1 | multipath-tools | 0.8.2+182.6d41865-150200.4.14.1 | SUSE-SU-2022:3709-1 |
| SUSE Manager Retail Branch Server 4.1 | multipath-tools | 0.8.2+182.6d41865-150200.4.14.1 | SUSE-SU-2022:3709-1 |
| SUSE Manager Proxy 4.1 | multipath-tools | 0.8.2+182.6d41865-150200.4.14.1 | SUSE-SU-2022:3709-1 |
| SUSE Enterprise Storage 7 | multipath-tools | 0.8.2+182.6d41865-150200.4.14.1 | SUSE-SU-2022:3709-1 |
| SUSE Enterprise Storage 6 | multipath-tools | 0.7.9+232+suse.cbc3754-150100.3.20.1 | SUSE-SU-2022:3708-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.4 | multipath-tools | 0.9.0+62+suse.3e048d4-150400.4.7.1 | SUSE-SU-2022:3711-1 |
| openSUSE Leap 15.3 | multipath-tools | 0.8.5+126+suse.8ce8da5-150300.2.14.1 | SUSE-SU-2022:3710-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap Micro 5.2 | multipath-tools | 0.8.5+126+suse.8ce8da5-150300.2.14.1 | SUSE-SU-2022:3710-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | kpartx +5 | 0.8.7-16.amzn2023.0.1 | ALAS2023-2023-126 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 2 (CBL-Mariner) | device-mapper-multipath | 0.8.6-4 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | kpartx +3 | 0.8.7-20.el9 | ELSA-2023-2459 |
| Oracle Linux 8 | kpartx +4 | 0.8.4-37.el8 | ELSA-2023-2948 |
Advisories 17
- ALSA-2023:2459 Moderate: device-mapper-multipath security and bug fix update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2023:2948 Moderate: device-mapper-multipath security and bug fix update AlmaLinux Security Advisories · Oct 29, 2026
- WID-SEC-2023-1185 Red Hat Enterprise Linux: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 3, 2026
- RHSA-2024:1110 Red Hat Security Advisory: device-mapper-multipath security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2023:2948 Red Hat Security Advisory: device-mapper-multipath security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2023:2459 Red Hat Security Advisory: device-mapper-multipath security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-5366-1 multipath-tools - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-3250-1 multipath-tools - security update Debian Security (DSA / DLA) · Mar 9, 2026
- USN-5731-1 multipath-tools vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
- SUSE-SU-2022:3708-1 Security update for multipath-tools SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:3710-1 Security update for multipath-tools SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:3707-1 Security update for multipath-tools SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:3711-1 Security update for multipath-tools SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:3709-1 Security update for multipath-tools SUSE / openSUSE Security Updates · Feb 4, 2026
- ELSA-2023-2948 Moderate: device-mapper-multipath security and bug fix update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · May 24, 2023
- ELSA-2023-2459 Moderate: device-mapper-multipath security and bug fix update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · May 15, 2023
- ALAS2023-2023-126 Important: device-mapper-multipath security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Mar 8, 2023
References
- https://bugzilla.suse.com/show_bug.cgi?id=1202739
- https://github.com/opensvc/multipath-tools/releases/tag/0.9.2
- http://www.openwall.com/lists/oss-security/2022/10/24/2
- 20221030 Authorization bypass and symlink attack in multipathd (CVE-2022-41974 and CVE-2022-41973) mailing-list
- http://packetstormsecurity.com/files/169611/Leeloo-Multipath-Authorization-Bypass-Symlink-Attack.html
- FEDORA-2022-6ec78b2586 vendor-advisory
- https://www.qualys.com/2022/10/24/leeloo-multipath/leeloo-multipath.txt
- [oss-security] 20221130 Race condition in snap-confine's must_mkdir_and_open_with_perms() (CVE-2022-3328) mailing-list
- 20221208 Race condition in snap-confine's must_mkdir_and_open_with_perms() (CVE-2022-3328) mailing-list
- http://packetstormsecurity.com/files/170176/snap-confine-must_mkdir_and_open_with_perms-Race-Condition.html
- [debian-lts-announce] 20221229 [SECURITY] [DLA 3250-1] multipath-tools security update mailing-list
- DSA-5366 vendor-advisory
- GLSA-202311-06 vendor-advisory