RHSA-2023:2459: Moderate: device-mapper-multipath security and bug fix update
The device-mapper-multipath packages provide tools that use the device-mapper multipath kernel module to manage multipath devices.Security Fix(es): device-mapper-multipath: multipathd: insecure handling of files in /dev/shm leading to symlink attack (CVE-2022-41973) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Additional Changes:For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.2 Release Notes linked from the References section.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2023:2459?
The severity of RHSA-2023:2459 is categorized as important due to the potential for a symlink attack.
How do I fix RHSA-2023:2459?
To fix RHSA-2023:2459, update the affected device-mapper-multipath packages to version 0.8.7-20.el9 or later.
What is the vulnerability described in RHSA-2023:2459?
RHSA-2023:2459 describes a vulnerability in device-mapper-multipath that allows insecure handling of files in /dev/shm, leading to a symlink attack.
Which packages are affected by RHSA-2023:2459?
The affected packages in RHSA-2023:2459 include device-mapper-multipath, kpartx, and several debuginfo and debugsource packages.
Is there a workaround for RHSA-2023:2459 until I can apply the fix?
A temporary workaround for RHSA-2023:2459 is to restrict access to the /dev/shm directory to reduce exposure to the symlink attack.