Amazon’s Hotpatch for Log4j Flaw Found Vulnerable to Privilege Escalation Bug

The “hotpatch” unveiled by Amazon Web Products and services (AWS) in reaction to the Log4Shell vulnerabilities could be leveraged for container escape and privilege escalation, permitting an attacker to seize command of the fundamental host.

“Apart from containers, unprivileged procedures can also exploit the patch to escalate privileges and get root code execution,” Palo Alto Networks Unit 42 researcher Yuval Avrahami claimed in a report revealed this 7 days.

✔ Approved Seller From Our Partners

Protect your privacy by Mullvad VPN. Mullvad VPN is one of the famous brands in the security and privacy world. With Mullvad VPN you will not even be asked for your email address. No log policy, no data from you will be saved. Get your license key now from the official distributor of Mullvad with discount: SerialCart® (Limited Offer).

➤ Get Mullvad VPN with 12% Discount

The issues — CVE-2021-3100, CVE-2021-3101, CVE-2022-0070, and CVE-2022-0071 (CVSS scores: 8.8) — affect the hotfix answers delivered by AWS, and stem from the point that they are designed to lookup for Java processes and patch them against the Log4j flaw on the fly but without having ensuring that the new Java processes are operate inside of the limitations imposed on the container.

“Any system managing a binary named ‘java’ – inside of or outside the house of a container – is thought of a candidate for the warm patch,” Avrahami elaborated. “A destructive container as a result could have bundled a malicious binary named ‘java’ to trick the set up incredibly hot patch answer into invoking it with elevated privileges.”

In the subsequent step, the elevated privileges could be weaponized by the malicious ‘java’ procedure to escape the container and obtain total management about the compromised server.

A rogue unprivileged process, in a related way, could have created and executed a destructive binary named “java” to trick the hotpatch company into operating it with elevated privileges.

End users are suggested to enhance to the mounted very hot patch model as shortly as feasible to prevent opportunity exploitation, but only after prioritizing patching against the actively exploited Log4Shell flaws.

“Containers are generally used as a security boundary amongst purposes working on the same machine,” Avrahami stated. “A container escape enables an attacker to lengthen a marketing campaign over and above a single application and compromise neighboring providers.”

Located this post interesting? Stick to THN on Fb, Twitter  and LinkedIn to examine much more distinctive content we submit.