CVE-2022-3787
📋 TL;DR
CVE-2022-3787 is a local privilege escalation vulnerability in device-mapper-multipath where attackers can bypass access controls by writing to UNIX domain sockets. This allows local users to gain root privileges, often exploited alongside CVE-2022-41973. Systems using device-mapper-multipath with vulnerable versions are affected.
💻 Affected Systems
- device-mapper-multipath
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Local attacker gains full root access to the system, enabling complete system compromise, data theft, and persistence.
Likely Case
Local users with write access to UNIX sockets escalate to root privileges, compromising system integrity.
If Mitigated
With proper access controls and patching, impact is limited to denial of service at most.
🎯 Exploit Status
Exploit requires local access and write permissions to UNIX sockets. Often chained with CVE-2022-41973.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Varies by distribution - check vendor advisories
Vendor Advisory: https://bugzilla.redhat.com/show_bug.cgi?id=2138959
Restart Required: Yes
Instructions:
1. Check your distribution's security advisory. 2. Update device-mapper-multipath package. 3. Restart affected services or reboot system.
🔧 Temporary Workarounds
Restrict socket permissions
linuxLimit write access to UNIX domain sockets used by multipath
chmod 660 /var/run/multipathd.sock
chown root:multipath /var/run/multipathd.sock
🧯 If You Can't Patch
- Implement strict access controls to limit local user privileges
- Monitor for suspicious activity involving multipathd or socket writes
🔍 How to Verify
Check if Vulnerable:
Check device-mapper-multipath version against vendor advisoriesCheck Version:
rpm -q device-mapper-multipath # For RPM systems
multipathd version # Check running versionVerify Fix Applied:
Verify updated package version and test multipath functionality📡 Detection & Monitoring
Log Indicators:
- Unauthorized access to /var/run/multipathd.sock
- Unexpected multipath configuration changes
- Privilege escalation attempts
Network Indicators:
- None - local exploit only
SIEM Query:
process:multipathd AND (file_access:/var/run/multipathd.sock OR privilege_escalation)