CVE-2022-3787

CVSS V2 None CVSS V3 None
Description
A vulnerability was found in the device-mapper-multipath. The device-mapper-multipath allows local users to obtain root access, exploited alone or in conjunction with CVE-2022-41973. Local users that are able to write to UNIX domain sockets can bypass access controls and manipulate the multipath setup. This issue occurs because an attacker can repeat a keyword, which is mishandled when arithmetic ADD is used instead of bitwise OR. This could lead to local privilege escalation to root.
Overview
  • CVE ID
  • CVE-2022-3787
  • Assigner
  • secalert@redhat.com
  • Vulnerability Status
  • Analyzed
  • Published Version
  • 2023-03-29T21:15:07
  • Last Modified Date
  • 2023-04-06T19:25:57
Weakness Enumerations
CWE URL
NVD-CWE-Other http://cwe.mitre.org/data/definitions/NVD-Other.html
CWE-285 http://cwe.mitre.org/data/definitions/285.html
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
cpe:2.3:a:redhat:device-mapper-multipath:-:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:redhat:enterprise_linux:8.7:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:redhat:enterprise_linux:9.1:*:*:*:*:*:*:* 1 OR
References
Reference URL Reference Tags
https://bugzilla.redhat.com/show_bug.cgi?id=2138959 Issue Tracking Vendor Advisory
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2022-3787
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3787
History
Created Old Value New Value Data Type Notes
2023-04-17 03:53:52 Added to TrackCVE
2023-04-17 03:53:55 Weakness Enumeration new