USN-5731-1: multipath-tools vulnerabilities

Releases

• Ubuntu 22.10
• Ubuntu 22.04 LTS
• Ubuntu 20.04 LTS
• Ubuntu 18.04 ESM

Packages

• multipath-tools - maintain multipath block device access

Details

It was discovered that multipath-tools incorrectly handled symlinks. A
local attacker could possibly use this issue, in combination with other
issues, to escalate privileges. This issue only affected Ubuntu 20.04 LTS,
Ubuntu 22.04 LTS, and Ubuntu 22.10. (CVE-2022-41973)

It was discovered that multipath-tools incorrectly handled access controls.
A local attacker could possibly use this issue, in combination with other
issues, to escalate privileges. (CVE-2022-41974)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 22.10

• multipath-tools - 0.8.8-1ubuntu1.22.10.1

Ubuntu 22.04

• multipath-tools - 0.8.8-1ubuntu1.22.04.1

Ubuntu 20.04

• multipath-tools - 0.8.3-1ubuntu2.1

Ubuntu 18.04

• multipath-tools - 0.7.4-2ubuntu3.2

In general, a standard system update will make all the necessary changes.

References

• CVE-2022-41974
• CVE-2022-41973