Amazon’s Hotpatch for Log4j Flaw Found Vulnerable to Privilege Escalation Bug

The “hotpatch” unveiled by Amazon Web Products and services (AWS) in reaction to the Log4Shell vulnerabilities could be leveraged for container escape and privilege escalation, permitting an attacker to seize command of the fundamental host.

“Apart from containers, unprivileged procedures can also exploit the patch to escalate privileges and get root code execution,” Palo Alto Networks Unit 42 researcher Yuval Avrahami claimed in a report revealed this 7 days.

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

The issues — CVE-2021-3100, CVE-2021-3101, CVE-2022-0070, and CVE-2022-0071 (CVSS scores: 8.8) — affect the hotfix answers delivered by AWS, and stem from the point that they are designed to lookup for Java processes and patch them against the Log4j flaw on the fly but without having ensuring that the new Java processes are operate inside of the limitations imposed on the container.

“Any system managing a binary named ‘java’ – inside of or outside the house of a container – is thought of a candidate for the warm patch,” Avrahami elaborated. “A destructive container as a result could have bundled a malicious binary named ‘java’ to trick the set up incredibly hot patch answer into invoking it with elevated privileges.”

In the subsequent step, the elevated privileges could be weaponized by the malicious ‘java’ procedure to escape the container and obtain total management about the compromised server.

A rogue unprivileged process, in a related way, could have created and executed a destructive binary named “java” to trick the hotpatch company into operating it with elevated privileges.

End users are suggested to enhance to the mounted very hot patch model as shortly as feasible to prevent opportunity exploitation, but only after prioritizing patching against the actively exploited Log4Shell flaws.

“Containers are generally used as a security boundary amongst purposes working on the same machine,” Avrahami stated. “A container escape enables an attacker to lengthen a marketing campaign over and above a single application and compromise neighboring providers.”

Located this post interesting? Stick to THN on Fb, Twitter  and LinkedIn to examine much more distinctive content we submit.