CVE-2022-3787: Red Hat Device-mapper-multipath Escalation

CVE-2022-3787 Overview

A local privilege escalation vulnerability was discovered in the device-mapper-multipath component, which is used to manage multipath block devices in Linux systems. This vulnerability allows local users to obtain root access by exploiting a flaw in access control handling. The issue can be exploited alone or in conjunction with CVE-2022-41973 for enhanced attack capabilities.

Local users with the ability to write to UNIX domain sockets can bypass access controls and manipulate the multipath setup. The root cause is an improper handling of repeated keywords, where arithmetic ADD is used instead of bitwise OR when processing options, leading to authorization bypass and ultimately local privilege escalation to root.

Critical Impact

Local attackers can escalate privileges to root by manipulating UNIX domain socket communications with the multipathd daemon, potentially gaining complete control over affected Red Hat Enterprise Linux systems.

Affected Products

• Red Hat device-mapper-multipath
• Red Hat Enterprise Linux 8.7
• Red Hat Enterprise Linux 9.1

Discovery Timeline

• 2023-03-29 - CVE-2022-3787 published to NVD
• 2025-02-18 - Last updated in NVD database

Technical Details for CVE-2022-3787

Vulnerability Analysis

This vulnerability falls under the category of Authorization Bypass leading to Local Privilege Escalation. The device-mapper-multipath component is responsible for managing multipath I/O configurations, which allows systems to use multiple physical paths between a server and storage devices for redundancy and performance.

The core issue lies in how the multipathd daemon processes keyword options received through UNIX domain sockets. When parsing command options, the code uses arithmetic addition (ADD) instead of bitwise OR operations to combine flags. This implementation flaw means that by repeating certain keywords, an attacker can cause integer overflow or manipulation of the resulting flag values, effectively bypassing intended access control restrictions.

Once access controls are circumvented, an attacker with local access can manipulate the multipath configuration in ways that should be restricted to privileged users. This manipulation can be leveraged to achieve full root access on the affected system.

Root Cause

The vulnerability stems from an improper authorization check implementation (CWE-285: Improper Authorization). The multipathd daemon fails to properly validate access permissions when processing repeated keywords in socket communications. The use of arithmetic ADD instead of bitwise OR for combining authorization flags creates a logic flaw that allows attackers to craft malicious inputs that bypass the intended security checks.

Attack Vector

The attack requires local access to the system with the ability to write to the UNIX domain socket used by multipathd. An attacker would craft specially formatted messages with repeated keywords that exploit the arithmetic handling flaw. When the daemon processes these messages, the improper flag calculation results in elevated permissions being granted, allowing the attacker to execute privileged operations.

The vulnerability can be combined with CVE-2022-41973 for a more robust exploitation chain. The local nature of this attack means physical access or an existing foothold on the system is required, but once exploited, the attacker gains full root privileges.

Detection Methods for CVE-2022-3787

Indicators of Compromise

• Unusual activity on UNIX domain sockets associated with multipathd (typically /run/multipathd.sock)
• Unexpected multipath configuration changes not initiated by authorized administrators
• Suspicious local processes attempting repeated connections to multipathd socket

Detection Strategies

• Monitor system logs for unusual multipathd daemon activity or error messages indicating malformed requests
• Implement file integrity monitoring on multipath configuration files (/etc/multipath.conf)
• Deploy endpoint detection tools to identify privilege escalation attempts from non-privileged user accounts
• Track socket communication patterns for anomalous keyword repetition in multipathd requests

Monitoring Recommendations

• Enable audit logging for socket operations related to multipathd using auditd
• Monitor for unexpected process privilege changes using tools like SentinelOne's behavioral AI
• Review system authentication logs for successful privilege escalations following multipathd activity
• Implement real-time alerting on changes to multipath device configurations

How to Mitigate CVE-2022-3787

Immediate Actions Required

• Update device-mapper-multipath to the latest patched version provided by Red Hat
• Restrict UNIX domain socket permissions for multipathd to limit access to authorized users only
• Audit local user accounts and remove unnecessary access to systems running multipath configurations
• Apply the principle of least privilege to all accounts on affected systems

Patch Information

Red Hat has acknowledged this vulnerability and tracks it in Red Hat Bug Report #2138959. Administrators should apply the security updates provided by Red Hat for Enterprise Linux 8.7 and 9.1 as soon as they become available. Consult the Red Hat Customer Portal for the latest security advisories and patch availability for your specific distribution version.

Workarounds

• Restrict access to the multipathd UNIX domain socket by modifying file permissions to allow only root access
• Disable multipathd service if multipath functionality is not required in your environment
• Implement network segmentation to isolate systems requiring multipath until patches can be applied
• Use mandatory access control (SELinux policies) to restrict which processes can communicate with multipathd

# Restrict multipathd socket permissions
chmod 600 /run/multipathd.sock
chown root:root /run/multipathd.sock

# Verify multipath service status and disable if not needed
systemctl status multipathd
systemctl disable --now multipathd

# Check SELinux enforcement status
getenforce