CVE-2022-41973

This package provides the multipath tool and the multipathd daemon to manage dm-multipath devices. multipath can detect and set up multipath maps. multipathd sets up multipath maps automatically,monitors path devices for failure, removal, or addition, and applies the necessary changes to the multipath maps to ensure continuous availability of the map devices.

Security Fix(es):

multipath-tools 0.7.7 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited in conjunction with CVE-2022-41974. Local users able to access /dev/shm can change symlinks in multipathd due to incorrect symlink handling, which could lead to controlled file writes outside of the /dev/shm directory. This could be used indirectly for local privilege escalation to root.(CVE-2022-41973)

multipath-tools 0.7.7 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited in conjunction with CVE-2022-41974. Local users able to access /dev/shm can change symlinks in multipathd due to incorrect symlink handling, which could lead to controlled file writes outside of the /dev/shm directory. This could be used indirectly for local privilege escalation to root.

The device-mapper-multipath packages provide tools that use the device-mapper multipath kernel module to manage multipath devices.

Security Fix(es):

• device-mapper-multipath: multipathd: insecure handling of files in /dev/shm leading to symlink attack (CVE-2022-41973)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

The device-mapper-multipath packages provide tools that use the device-mapper multipath kernel module to manage multipath devices.

Security Fix(es):

• device-mapper-multipath: multipathd: insecure handling of files in /dev/shm leading to symlink attack (CVE-2022-41973)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

multipath-tools 0.7.7 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited in conjunction with CVE-2022-41974. Local users able to access /dev/shm can change symlinks in multipathd due to incorrect symlink handling, which could lead to controlled file writes outside of the /dev/shm directory. This could be used indirectly for local privilege escalation to root.

multipath-tools 0.7.7 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited in conjunction with CVE-2022-41974. Local users able to access /dev/shm can change symlinks in multipathd due to incorrect symlink handling, which could lead to controlled file writes outside of the /dev/shm directory. This could be used indirectly for local privilege escalation to root. (CVE-2022-41973) multipath-tools 0.7.0 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited alone or in conjunction with CVE-2022-41973. Local users able to write to UNIX domain sockets can bypass access controls and manipulate the multipath setup. This can lead to local privilege escalation to root. This occurs because an attacker can repeat a keyword, which is mishandled because arithmetic ADD is used instead of bitwise OR. (CVE-2022-41974)

These are all security issues fixed in the kpartx-0.9.2+57+suse.cf3c1e9-1.1 package on the GA media of openSUSE Tumbleweed.

This update for multipath-tools fixes the following issues:

• CVE-2022-41973: Fixed a symlink attack in multipathd. (bsc#1202739)
• CVE-2022-41974: Fixed an authorization bypass issue in multipathd. (bsc#1202739)
• Avoid linking to libreadline to avoid licensing issue (bsc#1202616)
• Fix that some zfcp devices have large/negative LUN IDs (bsc#1187534)

This update for multipath-tools fixes the following issues:

• CVE-2022-41973: Fixed a symlink attack in multipathd. (bsc#1202739)
• CVE-2022-41974: Fixed an authorization bypass issue in multipathd. (bsc#1202739)
• Avoid linking to libreadline to avoid licensing issue (bsc#1202616)
• Fix that some zfcp devices have large/negative LUN IDs (bsc#1187534)

This update for multipath-tools fixes the following issues:

• CVE-2022-41973: Fixed a symlink attack in multipathd. (bsc#1202739)
• CVE-2022-41974: Fixed an authorization bypass issue in multipathd. (bsc#1202739)
• Avoid linking to libreadline to avoid licensing issue (bsc#1202616)
• multipathd: add 'force_reconfigure' option (bsc#1189551) The command 'multipathd -kreconfigure' changes behavior: instead of reloading every map, it checks map configuration and reloads only modified maps. This speeds up the reconfigure operation substantially. The old behavior can be reinstated by setting 'force_reconfigure yes' in multipath.conf (not recommended). Note: 'force_reconfigure yes' is not supported in SLE15-SP4 and beyond, which provide the command 'multipathd -k'reconfigure all''
• multipathd: avoid stalled clients during reconfigure (bsc#1189551)
• multipathd: handle client disconnect correctly (bsc#1189551)

This update for multipath-tools fixes the following issues:

• CVE-2022-41973: Fixed a symlink attack in multipathd. (bsc#1202739)

• CVE-2022-41974: Fixed an authorization bypass issue in multipathd. (bsc#1202739)

• multipathd: add 'force_reconfigure' option (bsc#1189551) The command 'multipathd -kreconfigure' changes behavior: instead of reloading every map, it checks map configuration and reloads only modified maps. This speeds up the reconfigure operation substantially. The old behavior can be reinstated by setting 'force_reconfigure yes' in multipath.conf (not recommended). Note: 'force_reconfigure yes' is not supported in SLE15-SP4 and beyond, which provide the command 'multipathd -k'reconfigure all''

• multipathd: avoid stalled clients during reconfigure (bsc#1189551)

• multipathd: handle client disconnect correctly (bsc#1189551)

• Avoid linking to libreadline to avoid licensing issue (bsc#1202616)

• multipathd: don't switch to DAEMON_IDLE during startup (bsc#1197570)

• multipathd: disallow changing to/from fpin marginal paths on reconfig

• multipathd handle fpin events (bsc#1195506,jsc#PED-1448)

• multipath: fix exit status of multipath -T (bsc#1191900)

This update for multipath-tools fixes the following issues:

• CVE-2022-41973: Fixed a symlink attack in multipathd. (bsc#1202739)
• CVE-2022-41974: Fixed an authorization bypass issue in multipathd. (bsc#1202739)
• Avoid linking to libreadline to avoid licensing issue (bsc#1202616)
• libmultipath: fix find_multipaths_timeout for unknown hardware (bsc#1201483)
• multipath-tools: fix 'multipath -ll' for Native NVME Multipath devices (bsc#1201483)
• multipathd: don't switch to DAEMON_IDLE during startup (bsc#1199346, bsc#1197570)
• multipathd: avoid delays during uevent processing (bsc#1199347)
• multipathd: Don't keep starting TUR threads, if they always hang. (bsc#1199345)
• Fix busy loop with delayed_reconfigure (bsc#1199342)
• multipath.conf: add support for 'protocol' subsection in 'overrides' section to set certain config options by protocol.
• Removed the previously deprecated options getuid_callout, config_dir, multipath_dir, pg_timeout
• Add disclaimer about vendor support
• Change built-in defaults for NVMe: group by prio, and immediate failback
• Fixes for minor issues reported by coverity
• Fix for memory leak with uid_attrs
• Updates for built in hardware db
• Logging improvements
• multipathd: use remove_map_callback for delayed reconfigure
• Fix handling of path addition in read-only arrays on NVMe
• Updates of built-in hardware database
• libmultipath: only warn once about unsupported dev_loss_tmo

It was discovered that multipath-tools incorrectly handled symlinks. A local attacker could possibly use this issue, in combination with other issues, to escalate privileges. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 22.10. (CVE-2022-41973)

It was discovered that multipath-tools incorrectly handled access controls. A local attacker could possibly use this issue, in combination with other issues, to escalate privileges. (CVE-2022-41974)