Bug 2133988 (CVE-2022-41974)

Summary:	CVE-2022-41974 device-mapper-multipath: Authorization bypass, multipathd daemon listens for client connections on an abstract Unix socket
Product:	[Other] Security Response	Reporter:	Sandipan Roy <saroy>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:	Lin Li <lilin>
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	agk, arachman, bmarzins, heinzm, lilin, lveyde, lvm-team, michal.skrivanek, mperina, msnitzer, prajnoha, security-response-team, zkabelac
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A vulnerability was found in the device-mapper-multipath. The device-mapper-multipath allows local users to obtain root access, exploited alone or in conjunction with CVE-2022-41973. Local users that are able to write to UNIX domain sockets can bypass access controls and manipulate the multipath setup. This issue occurs because an attacker can repeat a keyword, which is mishandled when arithmetic ADD is used instead of bitwise OR. This could lead to local privilege escalation to root.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-05-16 15:15:48 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2133991, 2133992, 2133993, 2133994, 2133995, 2133996, 2133997, 2133998, 2133999, 2134905, 2136434, 2137416
Bug Blocks:	2133535

Description Sandipan Roy 2022-10-12 04:55:15 UTC

Qualys Security Advisory
https://www.qualys.com/2022/10/24/leeloo-multipath/leeloo-multipath.txt
https://www.openwall.com/lists/oss-security/2022/10/24/2

========================================================================
CVE-2022-41974: Authorization bypass
========================================================================

multipath-tools 0.7.0 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited alone or in conjunction with CVE-2022-41973. Local users able to write to UNIX domain sockets can bypass access controls and manipulate the multipath setup. This can lead to local privilege escalation to root. This occurs because an attacker can repeat a keyword, which is mishandled because arithmetic ADD is used instead of bitwise OR.

Comment 7 Guilherme de Almeida Suckevicz 2022-10-24 20:02:41 UTC

Created device-mapper-multipath tracking bugs for this issue:

Affects: fedora-all [bug 2137416]

Comment 8 errata-xmlrpc 2022-10-25 15:00:45 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2022:7185 https://access.redhat.com/errata/RHSA-2022:7185

Comment 9 errata-xmlrpc 2022-10-25 15:04:24 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions

Via RHSA-2022:7187 https://access.redhat.com/errata/RHSA-2022:7187

Comment 10 errata-xmlrpc 2022-10-25 15:06:26 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Extended Update Support

Via RHSA-2022:7188 https://access.redhat.com/errata/RHSA-2022:7188

Comment 11 errata-xmlrpc 2022-10-25 15:12:09 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2022:7186 https://access.redhat.com/errata/RHSA-2022:7186

Comment 12 errata-xmlrpc 2022-10-25 15:17:38 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2022:7192 https://access.redhat.com/errata/RHSA-2022:7192

Comment 13 errata-xmlrpc 2022-10-27 10:13:58 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Extended Update Support

Via RHSA-2022:7191 https://access.redhat.com/errata/RHSA-2022:7191

Comment 18 errata-xmlrpc 2022-11-22 15:28:34 UTC

This issue has been addressed in the following products:

  Red Hat Virtualization 4 for Red Hat Enterprise Linux 8

Via RHSA-2022:8598 https://access.redhat.com/errata/RHSA-2022:8598

Comment 19 Product Security DevOps Team 2023-05-16 15:15:46 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-41974