It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-141 advisory.

    multipath-tools 0.7.0 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited     alone or in conjunction with CVE-2022-41973. Local users able to write to UNIX domain sockets can bypass     access controls and manipulate the multipath setup. This can lead to local privilege escalation to root.
    This occurs because an attacker can repeat a keyword, which is mishandled because arithmetic ADD is used     instead of bitwise OR. (CVE-2022-41974)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3710-1 advisory.

  - multipath-tools 0.7.7 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited in     conjunction with CVE-2022-41974. Local users able to access /dev/shm can change symlinks in multipathd due     to incorrect symlink handling, which could lead to controlled file writes outside of the /dev/shm     directory. This could be used indirectly for local privilege escalation to root. (CVE-2022-41973)

  - multipath-tools 0.7.0 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited     alone or in conjunction with CVE-2022-41973. Local users able to write to UNIX domain sockets can bypass     access controls and manipulate the multipath setup. This can lead to local privilege escalation to root.
    This occurs because an attacker can repeat a keyword, which is mishandled because arithmetic ADD is used     instead of bitwise OR. (CVE-2022-41974)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3707-1 advisory.

  - multipath-tools 0.7.7 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited in     conjunction with CVE-2022-41974. Local users able to access /dev/shm can change symlinks in multipathd due     to incorrect symlink handling, which could lead to controlled file writes outside of the /dev/shm     directory. This could be used indirectly for local privilege escalation to root. (CVE-2022-41973)

  - multipath-tools 0.7.0 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited     alone or in conjunction with CVE-2022-41973. Local users able to write to UNIX domain sockets can bypass     access controls and manipulate the multipath setup. This can lead to local privilege escalation to root.
    This occurs because an attacker can repeat a keyword, which is mishandled because arithmetic ADD is used     instead of bitwise OR. (CVE-2022-41974)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2022:7185 advisory.

    The device-mapper-multipath packages provide tools that use the device-mapper multipath kernel module to     manage multipath devices.

    Security Fix(es):

    * device-mapper-multipath: Authorization bypass, multipathd daemon listens for client connections on an     abstract Unix socket (CVE-2022-41974)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of device-mapper-multipath installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-41974 advisory.

  - multipath-tools 0.7.0 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited     alone or in conjunction with CVE-2022-41973. Local users able to write to UNIX domain sockets can bypass     access controls and manipulate the multipath setup. This can lead to local privilege escalation to root.
    This occurs because an attacker can repeat a keyword, which is mishandled because arithmetic ADD is used     instead of bitwise OR. (CVE-2022-41974)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2022:7192 advisory.

  - device-mapper-multipath: Authorization bypass, multipathd daemon listens for client connections on an     abstract Unix socket (CVE-2022-41974)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2022:7185 advisory.

  - device-mapper-multipath: Authorization bypass, multipathd daemon listens for client connections on an     abstract Unix socket (CVE-2022-41974)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of AHV installed on the remote host is prior to 20220304.10019. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AHV-20220304.10019 advisory.

  - BIND 9.11.0 -> 9.11.36 9.12.0 -> 9.16.26 9.17.0 -> 9.18.0 BIND Supported Preview Editions: 9.11.4-S1 ->     9.11.36-S1 9.16.8-S1 -> 9.16.26-S1 Versions of BIND 9 earlier than those shown - back to 9.1.0, including     Supported Preview Editions - are also believed to be affected but have not been tested as they are EOL.
    The cache could become poisoned with incorrect records leading to queries being made to the wrong servers,     which might also result in false information being returned to clients. (CVE-2021-25220)

  - PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that     may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos application server) on 32-bit     platforms (which have a resultant heap-based buffer overflow), and cause a denial of service on other     platforms. This occurs in krb5_pac_parse in lib/krb5/krb/pac.c. Heimdal before 7.7.1 has a similar bug.
    (CVE-2022-42898)

  - In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-     provided environment variables (SUDO_EDITOR, VISUAL, and EDITOR), allowing a local attacker to append     arbitrary entries to the list of files to process. This can lead to privilege escalation. Affected     versions are 1.8.0 through 1.9.12.p1. The problem exists because a user-specified editor may contain a
    -- argument that defeats a protection mechanism, e.g., an EDITOR='vim -- /path/to/extra/file' value.
    (CVE-2023-22809)

  - libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c. (CVE-2022-40674)

  - By spoofing the target resolver with responses that have a malformed ECDSA signature, an attacker can     trigger a small memory leak. It is possible to gradually erode available memory to the point where named     crashes for lack of resources. (CVE-2022-38177)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

multipath-tools 0.7.0 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited alone or in conjunction with CVE-2022-41973. Local users able to write to UNIX domain sockets can bypass access controls and manipulate the multipath setup. This can lead to local privilege escalation to root. This occurs because an attacker can repeat a keyword, which is mishandled because arithmetic ADD is used instead of bitwise OR.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

ID	Name	Product	Family	Published	Updated	Severity
173341	Amazon Linux 2023 : device-mapper-multipath, device-mapper-multipath-devel, device-mapper-multipath-libs (ALAS2023-2023-141)	Nessus	Amazon Linux Local Security Checks	3/23/2023	12/11/2024	high
166447	SUSE SLED15 / SLES15 Security Update : multipath-tools (SUSE-SU-2022:3710-1)	Nessus	SuSE Local Security Checks	10/25/2022	7/14/2023	high
166456	SUSE SLES12 Security Update : multipath-tools (SUSE-SU-2022:3707-1)	Nessus	SuSE Local Security Checks	10/25/2022	7/14/2023	high
166463	RHEL 9 : device-mapper-multipath (RHSA-2022:7185)	Nessus	Red Hat Local Security Checks	10/25/2022	11/7/2024	high
172735	CBL Mariner 2.0 Security Update: device-mapper-multipath (CVE-2022-41974)	Nessus	MarinerOS Local Security Checks	3/20/2023	2/10/2025	high
166524	AlmaLinux 8 : device-mapper-multipath (ALSA-2022:7192)	Nessus	Alma Linux Local Security Checks	10/26/2022	12/1/2022	high
166614	AlmaLinux 9 : device-mapper-multipath (ALSA-2022:7185)	Nessus	Alma Linux Local Security Checks	10/27/2022	11/30/2022	high
173373	Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-20220304.10019)	Nessus	Misc.	3/24/2023	2/19/2025	medium
503243	ABB M2M Gateway Improper Privilege Management in embedded Device-mapper-multipath (CVE-2022-41974)	Tenable OT Security	Tenable.ot	5/27/2025	5/27/2025	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

medium

high