RHSA-2023:2948: Moderate: device-mapper-multipath security and bug fix update
The device-mapper-multipath packages provide tools that use the device-mapper multipath kernel module to manage multipath devices.Security Fix(es): device-mapper-multipath: multipathd: insecure handling of files in /dev/shm leading to symlink attack (CVE-2022-41973) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Additional Changes:For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.8 Release Notes linked from the References section.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the security vulnerability identified in RHSA-2023:2948?
The security vulnerability RHSA-2023:2948 involves insecure handling of files in /dev/shm leading to a symlink attack in the device-mapper-multipath package.
What are the affected packages for RHSA-2023:2948?
The affected packages for RHSA-2023:2948 include device-mapper-multipath, device-mapper-multipath-debuginfo, kpartx, and their debug counterparts across various architectures.
How do I fix the vulnerability RHSA-2023:2948?
To fix the vulnerability RHSA-2023:2948, update the affected packages to version 0.8.4-37.el8 or later.
What is the impact of the vulnerability RHSA-2023:2948?
The impact of RHSA-2023:2948 could allow a local attacker to exploit insecure file handling, potentially overwriting arbitrary files.
Is there a workaround available for the issues in RHSA-2023:2948?
No specific workaround is suggested for RHSA-2023:2948; the recommended action is to update the affected packages promptly.