It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-126 advisory.

    A vulnerability was found in the device-mapper-multipath. The device-mapper-multipath allows local users     to obtain root access, exploited alone or in conjunction with CVE-2022-41973. Local users that are able to     write to UNIX domain sockets can bypass access controls and manipulate the multipath setup. This issue     occurs because an attacker can repeat a keyword, which is mishandled when arithmetic ADD is used instead     of bitwise OR. This could lead to local privilege escalation to root. (CVE-2022-3787)

    A vulnerability was found in the device-mapper-multipath. The device-mapper-multipath allows local users     to obtain root access, in conjunction with CVE-2022-41974. Local users that are able to access /dev/shm     can change symlinks in multipathd due to incorrect symlink handling, which may lead to controlled file     writes outside of the /dev/shm directory. This could be used indirectly for local privilege escalation to     root. (CVE-2022-41973)

    multipath-tools 0.7.0 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited     alone or in conjunction with CVE-2022-41973. Local users able to write to UNIX domain sockets can bypass     access controls and manipulate the multipath setup. This can lead to local privilege escalation to root.
    This occurs because an attacker can repeat a keyword, which is mishandled because arithmetic ADD is used     instead of bitwise OR. (CVE-2022-41974)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:7928 advisory.

  - A vulnerability was found in the device-mapper-multipath. The device-mapper-multipath allows local users     to obtain root access, exploited alone or in conjunction with CVE-2022-41973. Local users that are able to     write to UNIX domain sockets can bypass access controls and manipulate the multipath setup. This issue     occurs because an attacker can repeat a keyword, which is mishandled when arithmetic ADD is used instead     of bitwise OR. This could lead to local privilege escalation to root. (CVE-2022-3787)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0919 advisory.

    This advisory aggregates security fixes for the device-mapper-multipath SRPM in CIQ LTS 8.6. It addresses     2 CVEs: CVE-2022-3787, CVE-2022-41974.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-8453 advisory.

    [0.8.7-12.1]
    - Add 0062-multipathd-ignore-duplicated-multipathd-command-keys.patch
    - Resolves: bz #2133998

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2022:7928 advisory.

  - device-mapper-multipath: Regression of CVE-2022-41974 fix in Red Hat Enterprise Linux (CVE-2022-3787)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2023-5087:02 advisory.

    * device-mapper-multipath: Regression of CVE-2022-41974 fix in MIRACLE LINUX (CVE-2022-3787)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Rocky Linux 8.8 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-2026_0361 advisory.

    This advisory aggregates security fixes for the device-mapper-multipath SRPM in CIQ LTS 8.8. It addresses     1 CVE: CVE-2022-3787.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-2022_7928 advisory.

    * device-mapper-multipath: Regression of CVE-2022-41974 fix in Rocky Linux (CVE-2022-3787)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-7928 advisory.

    [0.8.4-28.1]
    - Add 0111-multipathd-ignore-duplicated-multipathd-command-keys.patch
    - Resolves: bz #2133995

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:8453 advisory.

  - A vulnerability was found in the device-mapper-multipath. The device-mapper-multipath allows local users     to obtain root access, exploited alone or in conjunction with CVE-2022-41973. Local users that are able to     write to UNIX domain sockets can bypass access controls and manipulate the multipath setup. This issue     occurs because an attacker can repeat a keyword, which is mishandled when arithmetic ADD is used instead     of bitwise OR. This could lead to local privilege escalation to root. (CVE-2022-3787)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2022-4432:08 advisory.

    * device-mapper-multipath: Regression of CVE-2022-41974 fix in MIRACLE LINUX (CVE-2022-3787)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
173185	Amazon Linux 2023 : device-mapper-multipath, device-mapper-multipath-devel, device-mapper-multipath-libs (ALAS2023-2023-126)	Nessus	Amazon Linux Local Security Checks	2023/3/21	2024/12/11	high
170782	Rocky Linux 8 : device-mapper-multipath (RLSA-2022:7928)	Nessus	Rocky Linux Local Security Checks	2023/1/30	2023/4/11	high
353631	Rocky Linux 8.6 [CIQ] Security Update: device-mapper-multipath / device-mapper-multipath-debuginfo / etc Multiple Vulnerabilities (ciqsa-2026_0919)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	high
168162	Oracle Linux 9 : device-mapper-multipath (ELSA-2022-8453)	Nessus	Oracle Linux Local Security Checks	2022/11/24	2024/11/1	high
167506	AlmaLinux 8 : device-mapper-multipath (ALSA-2022:7928)	Nessus	Alma Linux Local Security Checks	2022/11/15	2023/4/7	high
292334	MiracleLinux 9 : device-mapper-multipath-0.8.7-12.el9.1 (AXSA:2023-5087:02)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	high
353887	Rocky Linux 8.8 [CIQ] Security Update: device-mapper-multipath / device-mapper-multipath-debuginfo / etc (ciqsa-2026_0361)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	high
358217	Rocky Linux 8 [CIQ] Security Update: device-mapper-multipath / device-mapper-multipath-debuginfo / etc (crlsa-2022_7928)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	high
167783	Oracle Linux 8 : device-mapper-multipath (ELSA-2022-7928)	Nessus	Oracle Linux Local Security Checks	2022/11/17	2024/11/2	high
184635	Rocky Linux 9 : device-mapper-multipath (RLSA-2022:8453)	Nessus	Rocky Linux Local Security Checks	2023/11/6	2023/11/6	high
292318	MiracleLinux 8 : device-mapper-multipath-0.8.4-28.el8.1 (AXSA:2022-4432:08)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

high