CVE-2022-3787 Privilege escalation in device-mapper-multipath
Local attackers can escalate privileges to root by manipulating multipath setup via UNIX domain sockets due to improper access control handling.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-3787?
CVE-2022-3787 is a high-severity vulnerability in Redhat Enterprise Linux, published on 29 Mar 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability was found in the device-mapper-multipath. The device-mapper-multipath allows local users to obtain root access, exploited alone or in conjunction with CVE-2022-41973. Local users that are able to write to UNIX domain sockets can bypass access controls and manipulate the multipath setup. This issue occurs because an attacker can repeat a keyword, which is mishandled when arithmetic ADD is used instead of bitwise OR. This could lead to local privilege escalation to root.
Weakness: CWE-285
Which versions are affected by CVE-2022-3787?
It affects 2 products.
Linux distribution packages (4)
device-mapper-multipath Red Hat:enterprise_linux:8::baseos | All versions | 0:0.8.4-28.el8_7.1 |
device-mapper-multipath Red Hat:enterprise_linux:9::baseos | All versions | 0:0.8.7-12.el9_1.1 |
device-mapper-multipath Rocky Linux:8 | All versions | 0:0.8.4-28.el8_7.1 |
device-mapper-multipath Rocky Linux:9 | All versions | 0:0.8.7-12.el9_1.1 |
Products include Redhat Device-Mapper-Multipath, Redhat Enterprise Linux.
How do I fix CVE-2022-3787?
Apply the vendor's patch.
Is CVE-2022-3787 being exploited?
There is no known exploitation of CVE-2022-3787 in the wild and no public exploit code.
Sources
Also known as GHSA-m46g-8pc6-m8q7, RHSA-2022:7928, RHSA-2022:8453, RLSA-2022:7928, RLSA-2022:8453.