AWS released hotpatches for the Log4Shell vulnerability just days after it was discovered in December, creating a new set of major security weaknesses in the process.
Researchers from Palo Alto Networks Unit 42 reported the now-patched hotpatch issues this week, which permitted container escape and unprivileged process escalation.
In each situation, exploitation leads in root privilege code execution.
“After installing the patch service to a server or cluster, every container in that environment can exploit it to take over its underlying host,” Unit 42 noted in their disclosure.
“If you apply the hot patch to a Kubernetes cluster, for example, any container in the cluster can now escape until you disable the hot patch or update to the fixed version.” Unprivileged processes, in addition to containers, can use the patch to escalate privileges and acquire root code execution.
The advice stated that “containers can escape regardless of whether they execute Java apps or whether their underlying host runs Bottlerocket, AWS’ hardened Linux distribution for containers.”
CVE-2021-3100, CVE-2021-3101, CVE-2022-0070, and CVE-2022-0071 are the new vulnerabilities.
According to Unit 42, the problem occurred when a process attempted to acquire a Java binary and inject the hotpatch, but “they executed container binaries without correctly containerising them.” That is, the new processes would not be constrained in the way that container processes are.”
“And without the isolation technologies that would ordinarily constrain containers,” the repair also executed as root, regardless of the container’s user.
If an attacker added a malicious binary called “java,” the hotpatch with elevated binaries would call it and take control of the underlying host.
The notice from Amazon recognising the issue and providing patch instructions can be found here.
