{"id":"CVE-2022-3787","aliases":["ALSA-2022:7928","ALSA-2022:8453","EUVD-2022-43134","GHSA-m46g-8pc6-m8q7","RHSA-2022:7928","RHSA-2022:8453","RLSA-2022:7928","RLSA-2022:8453"],"status":"published","title":"A vulnerability was found in the device-mapper-multipath. The device-mapper-multipath allows...","description":"A vulnerability was found in the device-mapper-multipath. The device-mapper-multipath allows local users to obtain root access, exploited alone or in conjunction with CVE-2022-41973. Local users that are able to write to UNIX domain sockets can bypass access controls and manipulate the multipath setup. This issue occurs because an attacker can repeat a keyword, which is mishandled when arithmetic ADD is used instead of bitwise OR. This could lead to local privilege escalation to root.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00216,"percentile":0.12104,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-285"],"published":"2022-11-14T00:00:00Z","modified":"2026-10-29T11:30:44Z","fixes":[{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"device-mapper-multipath","fixed_in":["0:0.8.4-28.el8_7.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"device-mapper-multipath","fixed_in":["0:0.8.7-12.el9_1.1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"device-mapper-multipath","fixed_in":["0:0.8.4-28.el8_7.1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"device-mapper-multipath","fixed_in":["0:0.8.7-12.el9_1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:8","package":"device-mapper-multipath","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.4-28.el8_7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"device-mapper-multipath","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.7-12.el9_1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"device-mapper-multipath","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8.4-28.el8_7.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"device-mapper-multipath","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8.7-12.el9_1.1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"device-mapper-multipath","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8.4-28.el8_7.1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"device-mapper-multipath","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8.7-12.el9_1.1"}]}]}],"products":[{"vendor":"microsoft","product":"device-mapper-multipath"},{"vendor":"redhat","product":"device-mapper-multipath"},{"vendor":"redhat","product":"enterprise_linux"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2138959","tags":["x_transferred","Issue Tracking","Vendor Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-3787","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-m46g-8pc6-m8q7"},{"url":"https://access.redhat.com/errata/RHSA-2022:7928","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-3787","tags":["report"]},{"url":"https://bugzilla.redhat.com/2138959","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2022-7928.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:8453","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2022-8453.html","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_7928.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-3787","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_8453.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2022:7928","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2022:8453","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-3787","description":"A vulnerability was found in the device-mapper-multipath. The device-mapper-multipath allows local users to obtain root access, exploited alone or in conjunction with CVE-2022-41973. Local users that are able to write to UNIX domain sockets can bypass access controls and manipulate the multipath setup. This issue occurs because an attacker can repeat a keyword, which is mishandled when arithmetic ADD is used instead of bitwise OR. This could lead to local privilege escalation to root.","status":"published","published":"2023-03-29T00:00:00Z","modified":"2025-02-18T19:34:36.964Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T14:34:33.24035Z"}],"euvd":[{"id":"EUVD-2022-43134","description":"A vulnerability was found in the device-mapper-multipath. The device-mapper-multipath allows local users to obtain root access, exploited alone or in conjunction with CVE-2022-41973. Local users that are able to write to UNIX domain sockets can bypass access controls and manipulate the multipath setup. This issue occurs because an attacker can repeat a keyword, which is mishandled when arithmetic ADD is used instead of bitwise OR. This could lead to local privilege escalation to root.","status":"published","published":"2023-03-29T00:00:00Z","modified":"2025-02-18T19:34:36Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:53:28.492188Z"}],"ghsa":[{"id":"GHSA-m46g-8pc6-m8q7","title":"A vulnerability was found in the device-mapper-multipath. The device-mapper-multipath allows...","description":"A vulnerability was found in the device-mapper-multipath. The device-mapper-multipath allows local users to obtain root access, exploited alone or in conjunction with CVE-2022-41973. Local users that are able to write to UNIX domain sockets can bypass access controls and manipulate the multipath setup. This issue occurs because an attacker can repeat a keyword, which is mishandled when arithmetic ADD is used instead of bitwise OR. This could lead to local privilege escalation to root.","status":"published","published":"2023-03-29T21:30:16Z","modified":"2025-02-18T21:33:12Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T14:59:58.679357Z"}],"nvd":[{"id":"CVE-2022-3787","description":"A vulnerability was found in the device-mapper-multipath. The device-mapper-multipath allows local users to obtain root access, exploited alone or in conjunction with CVE-2022-41973. Local users that are able to write to UNIX domain sockets can bypass access controls and manipulate the multipath setup. This issue occurs because an attacker can repeat a keyword, which is mishandled when arithmetic ADD is used instead of bitwise OR. This could lead to local privilege escalation to root.","status":"published","published":"2023-03-29T21:15:07.903Z","modified":"2026-06-17T05:00:18.38Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T14:07:37.020555Z"}],"osv":[{"id":"RHSA-2022:7928","title":"Red Hat Security Advisory: device-mapper-multipath security update","status":"published","published":"2024-09-16T09:28:41Z","modified":"2026-06-26T12:22:06.127171077Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"RHSA-2022:8453","title":"Red Hat Security Advisory: device-mapper-multipath security update","status":"published","published":"2024-09-16T09:28:49Z","modified":"2026-06-26T12:22:29.788907652Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"RLSA-2022:7928","title":"Important: device-mapper-multipath security update","description":"The device-mapper-multipath packages provide tools that use the device-mapper multipath kernel module to manage multipath devices.\n\nSecurity Fix(es):\n\n* device-mapper-multipath: Regression of CVE-2022-41974 fix in Rocky Linux (CVE-2022-3787)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2022-11-14T08:45:46Z","modified":"2026-02-05T09:45:05.999577Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"RLSA-2022:8453","title":"Important: device-mapper-multipath security update","description":"The device-mapper-multipath packages provide tools that use the device-mapper multipath kernel module to manage multipath devices.\n\nSecurity Fix(es):\n\n* device-mapper-multipath: Regression of CVE-2022-41974 fix in Rocky Linux (CVE-2022-3787)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2022-11-15T15:35:59Z","modified":"2026-02-04T07:40:20.973183Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"ALSA-2022:7928","title":"Important: device-mapper-multipath security update","description":"The device-mapper-multipath packages provide tools that use the device-mapper multipath kernel module to manage multipath devices.\n\nSecurity Fix(es):\n\n* device-mapper-multipath: Regression of CVE-2022-41974 fix in AlmaLinux (CVE-2022-3787)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2022-11-14T00:00:00Z","modified":"2026-10-29T11:01:55.413631852Z","updated_at":"2026-11-02T15:27:51.655726Z"},{"id":"ALSA-2022:8453","title":"Important: device-mapper-multipath security update","description":"The device-mapper-multipath packages provide tools that use the device-mapper multipath kernel module to manage multipath devices.\n\nSecurity Fix(es):\n\n* device-mapper-multipath: Regression of CVE-2022-41974 fix in AlmaLinux (CVE-2022-3787)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2022-11-15T00:00:00Z","modified":"2026-10-29T11:30:44.861662836Z","updated_at":"2026-11-02T15:27:51.655726Z"}]}}