Denial of Service in multipathd via IPC Socket Blocking

Executive Summary

This is a Local Denial of Service (DoS) vulnerability in the multipathd daemon of the device-mapper-multipath component. An attacker with local access to the multipathd UNIX control socket can send valid commands but stop reading replies, causing the listener thread to block. This fills up the kernel's send buffer and prevents the daemon from processing further IPC requests, leading to a DoS for legitimate users.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for blocked IPC operations in multipathd. Check for hung listener threads or timeouts in multipathd logs. Use commands like 'systemctl status multipathd' to verify daemon status, 'ss -lpn | grep multipathd' to inspect socket connections, and 'journalctl -u multipathd --no-pager | grep -i block' to search for blocking events.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability can disrupt the availability of the multipathd IPC control path. Legitimate IPC operations may hang or time out, affecting system management tasks that rely on multipathd. However, it does not allow privilege escalation, code execution, or impact data confidentiality or integrity.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily impacts system availability, which could affect compliance with regulations requiring high availability of critical services. GDPR and HIPAA focus on data confidentiality and integrity, which are not directly impacted here. However, prolonged DoS conditions could indirectly affect compliance by disrupting service availability.

Useful 0 Not Useful 0

Mitigation Strategies

Restrict local access to the multipathd UNIX control socket to trusted administrators only. Update device-mapper-multipath to the latest patched version if available. Configure non-blocking sockets for IPC clients and avoid blocking operations in the listener thread.

Useful 0 Not Useful 0