CVE-2022-41974
multipath-tools 0.7.0 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited alone or in conjunction with CVE-2022-41973. L...
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
multipath-tools 0.7.0 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited alone or in conjunction with CVE-2022-41973. Local users able to write to UNIX domain sockets can bypass access controls and manipulate the multipath setup. This can lead to local privilege escalation to root. This occurs because an attacker can repeat a keyword, which is mishandled because arithmetic ADD is used instead of bitwise OR.
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- Debian DEBIAN-CVE-2022-41974 multipath-tools 修正版: 0.8.5-2+deb11u1
参照URL
- advisory github.com
- advisory lists.fedoraproject.org
- advisory nvd.nist.gov
- advisory security.gentoo.org
- advisory debian.org
- report bugzilla.suse.com
- web packetstormsecurity.com
- web packetstormsecurity.com
- web openwall.com
- web github.com
- web qualys.com
- web seclists.org
- web seclists.org
- web openwall.com
- web lists.debian.org