Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
multipath-tools may cause crashes or denial of service
published 1 month ago
Summary
The multipath-tools package on SUSE systems has several coding errors that could let attackers read memory they shouldn't, block communications, or overload the service, potentially leading to crashes or loss of functionality. Updating to the latest version (0.7.9+256) fixes these problems by adding proper checks and improving handling of inputs. Apply the provided update as soon as possible to keep your systems stable and secure.
What to do
- Update suse multipath-tools to version 0.7.9+256+suse.60d6bf4-3.23.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | suse | multipath-tools |
< 0.7.9+256+suse.60d6bf4-3.23.1 Fix: upgrade to 0.7.9+256+suse.60d6bf4-3.23.1
|
Original advisory text
Security update for multipath-tools
This update for multipath-tools fixes the following issues:
- Heap Out-of-Bounds Read in Custom Format String Parser via Trailing `%` (bsc#1277205).
- Path traversal in device-mapper-multipath failed_wwids management (bsc#1277210).
- SCSI PRIN READ FULL STATUS responses can cause heap buffer overflows (bsc#1277212).
- Local Denial of Service via Blocking IPC Send Operations (bsc#1277199).
- Heap Out-of-Bounds Read in GPT Header Validation (bsc#1277209).
- DoS on multipathd socket by exhausting connections (bsc#1277203).
- Heap out-of-bounds read in device-mapper-multipath ALUA RTPG parsing (bsc#1277208).
Changes for multipath-tools:
- Update to version 0.7.9+256+suse.60d6bf4.
- Add missing NULL check in DM parser (gh#opensvc/multipath-tools#155).
- Heap Out-of-Bounds Read in Custom Format String Parser via Trailing `%` (bsc#1277205).
- Path traversal in device-mapper-multipath failed_wwids management (bsc#1277210).
- SCSI PRIN READ FULL STATUS responses can cause heap buffer overflows (bsc#1277212).
- Local Denial of Service via Blocking IPC Send Operations (bsc#1277199).
- Heap Out-of-Bounds Read in GPT Header Validation (bsc#1277209).
- DoS on multipathd socket by exhausting connections (bsc#1277203).
- Heap out-of-bounds read in device-mapper-multipath ALUA RTPG parsing (bsc#1277208).
Changes for multipath-tools:
- Update to version 0.7.9+256+suse.60d6bf4.
- Add missing NULL check in DM parser (gh#opensvc/multipath-tools#155).
References
- https://www.suse.com/support/update/announcement/2026/suse-su-20264093-1/ Vendor Advisory
- https://bugzilla.suse.com/1277199 Third Party Advisory
- https://bugzilla.suse.com/1277203 Third Party Advisory
- https://bugzilla.suse.com/1277205 Third Party Advisory
- https://bugzilla.suse.com/1277208 Third Party Advisory
- https://bugzilla.suse.com/1277209 Third Party Advisory
- https://bugzilla.suse.com/1277210 Third Party Advisory
- https://bugzilla.suse.com/1277212 Third Party Advisory
Timeline
Published8 Sep 2026
Updated13 Sep 2026
First seen13 Sep 2026
Sources
SUSE-SU-2026:4093-1 · OSV
Track software like this
Free during beta