CVE-2022-41973

Katalog CVE

CVSS 7.8 · High EPSS 0,70%

Kerentanan Improper Link Resolution Before File Access ('Link Following') pada opensvc multipath-tools, fedoraproject fedora +1 lainnya. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

multipath-tools 0.7.7 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited in conjunction with CVE-2022-41974. Local users able to access /dev/shm can change symlinks in multipathd due to incorrect symlink handling, which could lead to controlled file writes outside of the /dev/shm directory. This could be used indirectly for local privilege escalation to root.

Rincian

Terbit di NVD

29 Oktober 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-59: Improper Link Resolution Before File Access ('Link Following')

EPSS (30 hari)

0,70% peluang dieksploitasi; lebih tinggi dari 51,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• http://packetstormsecurity.com/files/169611/Leeloo-Multipath-Authorization-Bypass-Symlink-Attack.html exploit · mailing list · advisory pihak ketiga · vdb entry
• http://packetstormsecurity.com/files/170176/snap-confine-must_mkdir_and_open_with_perms-Race-Condition.html exploit · advisory pihak ketiga
• http://seclists.org/fulldisclosure/2022/Dec/4 exploit · advisory pihak ketiga
• http://seclists.org/fulldisclosure/2022/Oct/25 exploit · mailing list · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2022/10/24/2 exploit · mailing list · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2022/11/30/2 exploit · advisory pihak ketiga
• https://bugzilla.suse.com/show_bug.cgi?id=1202739 issue tracking · advisory pihak ketiga
• https://github.com/opensvc/multipath-tools/releases/tag/0.9.2 release notes · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2022/12/msg00037.html mailing list · advisory pihak ketiga
• https://www.qualys.com/2022/10/24/leeloo-multipath/leeloo-multipath.txt exploit · advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QIGZM5NOOMFDC...
• https://security.gentoo.org/glsa/202311-06
• https://www.debian.org/security/2023/dsa-5366