Security update for multipath-tools

This security update for SUSE's multipath-tools addresses several vulnerabilities: heap out-of-bounds reads in the custom format string parser and GPT header validation, path traversal in device-mapper-multipath failed_wwids management, heap buffer overflows triggered by SCSI PRIN READ FULL STATUS responses, local denial of service via blocking IPC send operations, denial of service on the multipathd socket by exhausting connections, and heap out-of-bounds read in ALUA RTPG parsing. The update also includes a missing NULL check in the device-mapper parser. These fixes are incorporated in version 0.12.4+278+suse.9cf9c5c.

The vulnerabilities could lead to information disclosure through out-of-bounds reads, potential path traversal attacks, heap buffer overflows which may cause crashes or memory corruption, and denial of service conditions affecting local operations and multipathd socket availability. No known exploits in the wild have been reported. The impact is primarily on system stability and security integrity of multipath-tools components.

A security update is available that addresses all listed vulnerabilities by updating multipath-tools to version 0.12.4+278+suse.9cf9c5c. Users should apply this update promptly to mitigate the risks. No additional vendor advisories indicate alternative mitigations or that no action is required.