Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2022:3709-1

Опубликовано: 24 окт. 2022
Источник: suse-cvrf

Описание

Security update for multipath-tools

This update for multipath-tools fixes the following issues:

  • CVE-2022-41973: Fixed a symlink attack in multipathd. (bsc#1202739)
  • CVE-2022-41974: Fixed an authorization bypass issue in multipathd. (bsc#1202739)
  • Avoid linking to libreadline to avoid licensing issue (bsc#1202616)
  • multipathd: add 'force_reconfigure' option (bsc#1189551) The command 'multipathd -kreconfigure' changes behavior: instead of reloading every map, it checks map configuration and reloads only modified maps. This speeds up the reconfigure operation substantially. The old behavior can be reinstated by setting 'force_reconfigure yes' in multipath.conf (not recommended). Note: 'force_reconfigure yes' is not supported in SLE15-SP4 and beyond, which provide the command 'multipathd -k'reconfigure all''
  • multipathd: avoid stalled clients during reconfigure (bsc#1189551)
  • multipathd: handle client disconnect correctly (bsc#1189551)

Список пакетов

Image SLES15-SP2-SAP-Azure-LI-BYOS-Production
kpartx-0.8.2+182.6d41865-150200.4.14.1
multipath-tools-0.8.2+182.6d41865-150200.4.14.1
Image SLES15-SP2-SAP-Azure-VLI-BYOS-Production
kpartx-0.8.2+182.6d41865-150200.4.14.1
multipath-tools-0.8.2+182.6d41865-150200.4.14.1
SUSE Enterprise Storage 7
kpartx-0.8.2+182.6d41865-150200.4.14.1
libdmmp-devel-0.8.2+182.6d41865-150200.4.14.1
libdmmp0_2_0-0.8.2+182.6d41865-150200.4.14.1
multipath-tools-0.8.2+182.6d41865-150200.4.14.1
multipath-tools-devel-0.8.2+182.6d41865-150200.4.14.1
SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS
kpartx-0.8.2+182.6d41865-150200.4.14.1
libdmmp-devel-0.8.2+182.6d41865-150200.4.14.1
libdmmp0_2_0-0.8.2+182.6d41865-150200.4.14.1
multipath-tools-0.8.2+182.6d41865-150200.4.14.1
multipath-tools-devel-0.8.2+182.6d41865-150200.4.14.1
SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS
kpartx-0.8.2+182.6d41865-150200.4.14.1
libdmmp-devel-0.8.2+182.6d41865-150200.4.14.1
libdmmp0_2_0-0.8.2+182.6d41865-150200.4.14.1
multipath-tools-0.8.2+182.6d41865-150200.4.14.1
multipath-tools-devel-0.8.2+182.6d41865-150200.4.14.1
SUSE Linux Enterprise Server 15 SP2-BCL
kpartx-0.8.2+182.6d41865-150200.4.14.1
libdmmp-devel-0.8.2+182.6d41865-150200.4.14.1
libdmmp0_2_0-0.8.2+182.6d41865-150200.4.14.1
multipath-tools-0.8.2+182.6d41865-150200.4.14.1
multipath-tools-devel-0.8.2+182.6d41865-150200.4.14.1
SUSE Linux Enterprise Server 15 SP2-LTSS
kpartx-0.8.2+182.6d41865-150200.4.14.1
libdmmp-devel-0.8.2+182.6d41865-150200.4.14.1
libdmmp0_2_0-0.8.2+182.6d41865-150200.4.14.1
multipath-tools-0.8.2+182.6d41865-150200.4.14.1
multipath-tools-devel-0.8.2+182.6d41865-150200.4.14.1
SUSE Linux Enterprise Server for SAP Applications 15 SP2
kpartx-0.8.2+182.6d41865-150200.4.14.1
libdmmp-devel-0.8.2+182.6d41865-150200.4.14.1
libdmmp0_2_0-0.8.2+182.6d41865-150200.4.14.1
multipath-tools-0.8.2+182.6d41865-150200.4.14.1
multipath-tools-devel-0.8.2+182.6d41865-150200.4.14.1
SUSE Manager Proxy 4.1
kpartx-0.8.2+182.6d41865-150200.4.14.1
libdmmp-devel-0.8.2+182.6d41865-150200.4.14.1
libdmmp0_2_0-0.8.2+182.6d41865-150200.4.14.1
multipath-tools-0.8.2+182.6d41865-150200.4.14.1
multipath-tools-devel-0.8.2+182.6d41865-150200.4.14.1
SUSE Manager Retail Branch Server 4.1
kpartx-0.8.2+182.6d41865-150200.4.14.1
libdmmp-devel-0.8.2+182.6d41865-150200.4.14.1
libdmmp0_2_0-0.8.2+182.6d41865-150200.4.14.1
multipath-tools-0.8.2+182.6d41865-150200.4.14.1
multipath-tools-devel-0.8.2+182.6d41865-150200.4.14.1
SUSE Manager Server 4.1
kpartx-0.8.2+182.6d41865-150200.4.14.1
libdmmp-devel-0.8.2+182.6d41865-150200.4.14.1
libdmmp0_2_0-0.8.2+182.6d41865-150200.4.14.1
multipath-tools-0.8.2+182.6d41865-150200.4.14.1
multipath-tools-devel-0.8.2+182.6d41865-150200.4.14.1

Ссылки

Описание

multipath-tools 0.7.7 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited in conjunction with CVE-2022-41974. Local users able to access /dev/shm can change symlinks in multipathd due to incorrect symlink handling, which could lead to controlled file writes outside of the /dev/shm directory. This could be used indirectly for local privilege escalation to root.

Затронутые продукты
Image SLES15-SP2-SAP-Azure-LI-BYOS-Production:kpartx-0.8.2+182.6d41865-150200.4.14.1
Image SLES15-SP2-SAP-Azure-LI-BYOS-Production:multipath-tools-0.8.2+182.6d41865-150200.4.14.1
Image SLES15-SP2-SAP-Azure-VLI-BYOS-Production:kpartx-0.8.2+182.6d41865-150200.4.14.1
Image SLES15-SP2-SAP-Azure-VLI-BYOS-Production:multipath-tools-0.8.2+182.6d41865-150200.4.14.1
Ссылки

Описание

multipath-tools 0.7.0 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited alone or in conjunction with CVE-2022-41973. Local users able to write to UNIX domain sockets can bypass access controls and manipulate the multipath setup. This can lead to local privilege escalation to root. This occurs because an attacker can repeat a keyword, which is mishandled because arithmetic ADD is used instead of bitwise OR.

Затронутые продукты
Image SLES15-SP2-SAP-Azure-LI-BYOS-Production:kpartx-0.8.2+182.6d41865-150200.4.14.1
Image SLES15-SP2-SAP-Azure-LI-BYOS-Production:multipath-tools-0.8.2+182.6d41865-150200.4.14.1
Image SLES15-SP2-SAP-Azure-VLI-BYOS-Production:kpartx-0.8.2+182.6d41865-150200.4.14.1
Image SLES15-SP2-SAP-Azure-VLI-BYOS-Production:multipath-tools-0.8.2+182.6d41865-150200.4.14.1
Ссылки