CVE-2022-3787: High severity redhat device-mapper-multipath vulnerability
A vulnerability was found in the device-mapper-multipath. The device-mapper-multipath allows local users to obtain root access, exploited alone or in conjunction with CVE-2022-41973. Local users that are able to write to UNIX domain sockets can bypass access controls and manipulate the multipath setup. This issue occurs because an attacker can repeat a keyword, which is mishandled when arithmetic ADD is used instead of bitwise OR. This could lead to local privilege escalation to root.
Other sources
The device-mapper-multipath flaw CVE-2022-41974 (bug 2133988) was addressed in Red Hat Enterprise Linux 8 via erratum RHSA-2022:7192 and in Red Hat Enterprise Linux 9 via erratum RHSA-2022:7185, released on Oct 25, 2022:
https://access.redhat.com/errata/RHSA-2022:7192 https://access.redhat.com/errata/RHSA-2022:7185
However, the fix for this issue was not included in the device-mapper-multipath updates released as part of Red Hat Enterprise Linux 8.7 (RHBA-2022:7714) and 9.1 (RHBA-2022:8313), causing a security regression of previously released fix. A new CVE id CVE-2022-3787 was assigned for this security regression.
Note that this issue and CVE id is specific to the device-mapper-multipath packages as shipped with Red Hat Enterprise Linux and is not applicable to any upstream device-mapper-multipath version or device-mapper-multipath packages of any other vendor that are not directly based on Red Hat Enterprise Linux packages.
For more information about the original flaw, refer to the CVE page or bug linked above.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-3787?
CVE-2022-3787 is a vulnerability found in the device-mapper-multipath software that allows local users to obtain root access.
How can CVE-2022-3787 be exploited?
CVE-2022-3787 can be exploited by local users who are able to write to UNIX domain sockets, allowing them to bypass access controls and manipulate the multipath set.
Which software is affected by CVE-2022-3787?
CVE-2022-3787 affects Redhat Device-mapper-multipath versions, specifically Redhat Enterprise Linux 8.7 and 9.1.
What is the severity of CVE-2022-3787?
CVE-2022-3787 has a severity rating of 7.8 (high).
How can I fix CVE-2022-3787?
To fix CVE-2022-3787, it is recommended to apply the necessary patches or updates provided by Redhat Enterprise Linux.