CVE-2022-33915

Published on: Not Yet Published

Last Modified on: 07/05/2022 07:43:00 PM UTC

CVE-2022-33915

CVSS:3.1/AC:H/AV:L/A:H/C:H/I:H/PR:L/S:U/UI:N

Certain versions of Hotpatch from Amazon contain the following vulnerability:

Versions of the Amazon AWS Apache Log4j hotpatch package before log4j-cve-2021-44228-hotpatch-1.3.5 are affected by a race condition that could lead to a local privilege escalation. This Hotpatch package is not a replacement for updating to a log4j version that mitigates CVE-2021-44228 or CVE-2021-45046; it provides a temporary mitigation to CVE-2021-44228 by hotpatching the local Java virtual machines. To do so, it iterates through all running Java processes, performs several checks, and executes the Java virtual machine with the same permissions and capabilities as the running process to load the hotpatch. A local user could cause the hotpatch script to execute a binary with elevated privileges by running a custom java process that performs exec() of an SUID binary after the hotpatch has observed the process path and before it has observed its effective user ID.

CVE-2022-33915 has been assigned by [email protected] to track the vulnerability - currently rated as HIGH severity.

CVSS3 Score: 7 - HIGH

Attack Vector ^ⓘ	Attack Complexity	Privileges Required	User Interaction
LOCAL	HIGH	LOW	NONE
Scope	Confidentiality Impact	Integrity Impact	Availability Impact
UNCHANGED	HIGH	HIGH	HIGH

CVSS2 Score: 4.4 - MEDIUM

Access Vector^ⓘ	Access Complexity	Authentication
LOCAL	MEDIUM	NONE
Confidentiality Impact	Integrity Impact	Availability Impact
PARTIAL	PARTIAL	PARTIAL

CVE References

Description	Tags ^ⓘ	Link
ALAS2-2022-1806	alas.aws.amazon.com text/html	MISC alas.aws.amazon.com/AL2/ALAS-2022-1806.html
ALAS-2022-1601	alas.aws.amazon.com text/html	MISC alas.aws.amazon.com/ALAS-2022-1601.html

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].

There are currently no QIDs associated with this CVE

Known Affected Configurations (CPE V2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Application	Amazon	Hotpatch	All	All	All	All
Application	Apache	Log4j	All	All	All	All

cpe:2.3:a:amazon:hotpatch:*:*:*:*:*:log4j:*:*:
cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*:

No vendor comments have been submitted for this CVE

Social Mentions

Source	Title	Posted (UTC)
@CVEreport	CVE-2022-33915 : Versions of the Amazon AWS #Apache Log4j hotpatch package before log4j-cve-2021-44228-hotpatch-1.3… twitter.com/i/web/status/1…	2022-06-17 07:07:35
@LinInfoSec	Log4j - CVE-2022-33915: alas.aws.amazon.com/ALAS-2022-1601…	2022-06-17 15:01:58
@threatmeter	CVE-2022-33915 Versions of the Amazon AWS Apache Log4j hotpatch package before log4j-cve-2021-44228-hotpatch-1.3.5… twitter.com/i/web/status/1…	2022-06-18 07:09:13
/r/netcve	CVE-2022-33915	2022-06-17 08:38:47