According to Palo Alto Networks' research, an AWS hot patch released last year to address the Log4Shell vulnerability is vulnerable to privilege escalation and container escape vulnerabilities.
Â
Log4Shell is a critical vulnerability affecting popular Java logging framework Log4j 2. The flaw enables threat actors to easily and remotely execute malicious code against organizations with certain configurations.
Â
Amazon's first hot patch for AWS was released last year. It mitigated both the Log4Shell vulnerability and a related denial-of-service flaw. However, issues with the hot patch left vulnerable AWS customers exposed to privilege escalation and container escape bugs.
Â
Amazon released new hot patches for Amazon Linux and Linux 2. Both Amazon and Unit 42 recommended AWS customers update to this latest version. Researchers found “severe security issues” in the initial patch, and after installing it to a server or cluster, “every container in that environment can exploit it to take over its underlying host.”
Â
Palo Alto Networks Principal Security Researcher Yuval Avrahami said, “The issue was that they invoked container binaries without properly containerizing them. That is, the new processes would run without the limitations normally applied to container processes. A malicious container therefore could have included a malicious binary named 'java' to trick the installed hot patch solution into invoking it with elevated privileges. The malicious 'java' process could then abuse its elevated privileges to escape the container and take over the underlying host.”
Â
Avrahami added that with these flaws, organizations are vulnerable to container escape, regardless of whether the servers run Java applications or whether their host runs Bottlerocket, the Linux-powered AWS operating system used for running containers. Additionally, containers running with user namespaces or as a non-root user are affected as well.
