AWS's Log4Shell Hot Patch Vulnerable to Container Escape and Privilege Escalation
Summary: Unit 42 researchers found that AWS's Log4Shell hot patch solutions invoked container binaries such as "java" without proper containerization, spawning them with all Linux capabilities, without seccomp or cgroups, and as root regardless of the container's user. The flaws, tracked as CVE-2021-3100, CVE-2021-3101, CVE-2022-0070 and CVE-2022-0071, let any container in an affected cluster escape to its host and let unprivileged processes escalate to root, and AWS released a fixed version of each solution on April 19.
What you should know: A single container escape is sometimes enough to take over an entire Kubernetes cluster, and the flaws worked even on hosts running Bottlerocket or containers using user namespaces or non-root users. Many teams deployed these hot patches at scale during Log4Shell and kept them running for defense-in-depth, leaving multitenant clusters and clusters running untrusted images exposed.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2021-3100CVE-2021-3101CVE-2021-44228CVE-2022-0070CVE-2022-0071
- Related
- CVE-2021-44228: Apache Log4j2 Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Dec 10, 2021Log4Shell Everywhere Cyber Risks ·