Skip to content
Heist/ feed
Back to feed
Unrated

Security advisory

Type: advisorySources: OSVCVE: CVE-2022-41974

multipath-tools 0.7.0 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited alone or in conjunction with CVE-2022-41973. Local users able to write to UNIX domain sockets can bypass access controls and manipulate the multipath setup. This can lead to local privilege escalation to root. This occurs because an attacker can repeat a keyword, which is mishandled because arithmetic ADD is used instead of bitwise OR.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2022-41974
Confirmed fixed CVEs
Not specified
Updated in this feed
5 Nov 2026, 02:09 UTC · Revision 1

Source evidence

CVE-2022-41974

core-osv · Original source

Published 29 Oct 2022, 00:00 UTC

multipath-tools 0.7.0 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited alone or in conjunction with CVE-2022-41973. Local users able to write to UNIX domain sockets can bypass access controls and manipulate the multipath setup. This can lead to local privilege escalation to root. This occurs because an attacker can repeat a keyword, which is mishandled because arithmetic ADD is used instead of bitwise OR.

osv:CVE-2022-41974
Complete source record
{
  "id": "2d4edadd64ebc66dcdeee40e5c3eee6d0bf4f4b85353b8e4d7c95fe8af5b0d20",
  "url": "https://osv.dev/vulnerability/CVE-2022-41974",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "CVE-2022-41974",
    "summary": "multipath-tools 0.7.0 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited alone or in conjunction with CVE-2022-41973. Local users able to write to UNIX domain sockets can bypass access controls and manipulate the multipath setup. This can lead to local privilege escalation to root. This occurs because an attacker can repeat a keyword, which is mishandled because arithmetic ADD is used instead of bitwise OR.",
    "evidence": "osv:CVE-2022-41974",
    "products": [],
    "severity": "unknown",
    "structured": {
      "id": "CVE-2022-41974",
      "aliases": [
        "CVE-2022-41974"
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/opensvc/multipath-tools",
              "type": "GIT",
              "events": [
                {
                  "introduced": "fadb66a8935e1b2adff74ae53eac1dcc147db4f8"
                },
                {
                  "fixed": "66664cdb52f548b821b2ea28e49613c068e9375d"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:opensvc:multipath-tools:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "0.7.0"
                      },
                      {
                        "fixed": "0.9.2"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "range": [
                      {
                        "fixed": "66664cdb52f548b821b2ea28e49613c068e9375d"
                      }
                    ],
                    "source": "REFERENCES_TAG",
                    "original_tag": "0.9.2"
                  }
                ]
              }
            }
          ],
          "versions": [
            "0.9.1",
            "0.9.0",
            "0.8.9",
            "0.8.8",
            "0.8.7",
            "0.8.6",
            "0.8.5",
            "0.8.4",
            "0.8.3",
            "0.8.2",
            "0.8.1",
            "0.8.0",
            "0.7.9",
            "0.7.8",
            "0.7.7",
            "0.7.6",
            "0.7.5",
            "0.7.4",
            "0.7.3",
            "0.7.2",
            "0.7.1",
            "0.7.0"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-41974.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:41.852092698Z",
      "provider": "osv",
      "references": [
        "https://github.com/opensvc/multipath-tools/releases/tag/0.9.2",
        "https://www.qualys.com/2022/10/24/leeloo-multipath/leeloo-multipath.txt",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/41xxx/CVE-2022-41974.json",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QIGZM5NOOMFDCITOLQEJNNX5SCRQLQVV/",
        "https://nvd.nist.gov/vuln/detail/CVE-2022-41974",
        "https://security.gentoo.org/glsa/202311-06",
        "https://www.debian.org/security/2023/dsa-5366",
        "https://bugzilla.suse.com/show_bug.cgi?id=1202739",
        "https://lists.debian.org/debian-lts-announce/2022/12/msg00037.html"
      ],
      "provider_metadata": {
        "cna_assigner": "mitre",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/41xxx/CVE-2022-41974.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2022-41974",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 509399,
  "published_at": "2022-10-29T00:00:00+00:00"
}