Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
multipath-tools may crash or be tricked into denial of service
published 1 month ago
Summary
The multipath-tools package, which manages storage paths on Linux servers, contains several coding mistakes that could let an attacker cause the program to read invalid memory, crash, or block its communication channels. This could lead to temporary loss of storage management functions or allow malicious files to be accessed. Updating to the latest multipath-tools version (0.12.4+278) resolves these issues, so apply the provided patch as soon as possible.
What to do
- Update opensuse multipath-tools to version 0.12.4+278+suse.9cf9c5c-160000.1.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| openSUSE:Leap 16.0 | opensuse | multipath-tools |
< 0.12.4+278+suse.9cf9c5c-160000.1.1 Fix: upgrade to 0.12.4+278+suse.9cf9c5c-160000.1.1
|
Original advisory text
Security update for multipath-tools
This update for multipath-tools fixes the following issues:
- Heap Out-of-Bounds Read in Custom Format String Parser via Trailing `%` (bsc#1277205).
- Path traversal in device-mapper-multipath failed_wwids management (bsc#1277210).
- SCSI PRIN READ FULL STATUS responses can cause heap buffer overflows (bsc#1277212).
- Local Denial of Service via Blocking IPC Send Operations (bsc#1277199).
- Heap Out-of-Bounds Read in GPT Header Validation (bsc#1277209).
- DoS on multipathd socket by exhausting connections (bsc#1277203).
- Heap out-of-bounds read in device-mapper-multipath ALUA RTPG parsing (bsc#1277208).
Changes for multipath-tools:
- Update to version 0.12.4+278+suse.9cf9c5c.
- Add missing NULL check in DM parser (gh#opensvc/multipath-tools#155).
- Heap Out-of-Bounds Read in Custom Format String Parser via Trailing `%` (bsc#1277205).
- Path traversal in device-mapper-multipath failed_wwids management (bsc#1277210).
- SCSI PRIN READ FULL STATUS responses can cause heap buffer overflows (bsc#1277212).
- Local Denial of Service via Blocking IPC Send Operations (bsc#1277199).
- Heap Out-of-Bounds Read in GPT Header Validation (bsc#1277209).
- DoS on multipathd socket by exhausting connections (bsc#1277203).
- Heap out-of-bounds read in device-mapper-multipath ALUA RTPG parsing (bsc#1277208).
Changes for multipath-tools:
- Update to version 0.12.4+278+suse.9cf9c5c.
- Add missing NULL check in DM parser (gh#opensvc/multipath-tools#155).
References
- https://bugzilla.suse.com/1277199 Third Party Advisory
- https://bugzilla.suse.com/1277203 Third Party Advisory
- https://bugzilla.suse.com/1277205 Third Party Advisory
- https://bugzilla.suse.com/1277208 Third Party Advisory
- https://bugzilla.suse.com/1277209 Third Party Advisory
- https://bugzilla.suse.com/1277210 Third Party Advisory
- https://bugzilla.suse.com/1277212 Third Party Advisory
Timeline
Published7 Sep 2026
Updated10 Sep 2026
First seen10 Sep 2026
Sources
openSUSE-SU-2026:21802-1 · OSV
Track software like this
Free during beta