CVE-2022-0071 - OpenCVE

Incomplete fix for CVE-2021-3101. Hotdog, prior to v1.0.2, did not mimic the resource limits, device restrictions, or syscall filters of the target JVM process. This would allow a container to exhaust the resources of the host, modify devices, or make syscalls that would otherwise be blocked.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Local

Access Complexity Low

Authentication None

Confidentiality Impact Complete

Integrity Impact Complete

Availability Impact Complete

AV:L/AC:L/Au:N/C:C/I:C/A:C

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Hotdog Project	Hotdog

Configuration 1 [-]

cpe:2.3:a:hotdog_project:hotdog:*:*:*:*:*:java:*:*

No data.

References

Link	Providers
https://github.com/bottlerocket-os/hotdog/security/advisories/GHSA-jr96-7frv-3mpj
https://unit42.paloaltonetworks.com/aws-log4shell-hot-patch-vulnerabilities

History

No history.

MITRE

Status: PUBLISHED

Assigner: palo_alto

Published: 2022-04-19T22:15:25.022600Z

Updated: 2024-09-17T04:24:20.485Z

Reserved: 2021-12-28T00:00:00

Link: CVE-2022-0071

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2022-04-19T23:15:13.243

Modified: 2022-04-29T17:27:03.247

Link: CVE-2022-0071

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "Hotdog", "vendor": "Amazon Web Services", "versions": [{"lessThan": "1.0.2", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "Yuval Avrahami, Palo Alto Networks"}], "datePublic": "2022-04-19T00:00:00", "descriptions": [{"lang": "en", "value": "Incomplete fix for CVE-2021-3101. Hotdog, prior to v1.0.2, did not mimic the resource limits, device restrictions, or syscall filters of the target JVM process. This would allow a container to exhaust the resources of the host, modify devices, or make syscalls that would otherwise be blocked."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-250", "description": "CWE-250 Execution with Unnecessary Privileges", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-04-19T22:15:24", "orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0", "shortName": "palo_alto"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://unit42.paloaltonetworks.com/aws-log4shell-hot-patch-vulnerabilities"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/bottlerocket-os/hotdog/security/advisories/GHSA-jr96-7frv-3mpj"}], "source": {"discovery": "EXTERNAL"}, "title": "Hotdog Container Escape", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "psirt@paloaltonetworks.com", "DATE_PUBLIC": "2022-04-19T19:00:00.000Z", "ID": "CVE-2022-0071", "STATE": "PUBLIC", "TITLE": "Hotdog Container Escape"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Hotdog", "version": {"version_data": [{"version_affected": "<", "version_value": "1.0.2"}]}}]}, "vendor_name": "Amazon Web Services"}]}}, "credit": [{"lang": "eng", "value": "Yuval Avrahami, Palo Alto Networks"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Incomplete fix for CVE-2021-3101. Hotdog, prior to v1.0.2, did not mimic the resource limits, device restrictions, or syscall filters of the target JVM process. This would allow a container to exhaust the resources of the host, modify devices, or make syscalls that would otherwise be blocked."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-250 Execution with Unnecessary Privileges"}]}]}, "references": {"reference_data": [{"name": "https://unit42.paloaltonetworks.com/aws-log4shell-hot-patch-vulnerabilities", "refsource": "MISC", "url": "https://unit42.paloaltonetworks.com/aws-log4shell-hot-patch-vulnerabilities"}, {"name": "https://github.com/bottlerocket-os/hotdog/security/advisories/GHSA-jr96-7frv-3mpj", "refsource": "MISC", "url": "https://github.com/bottlerocket-os/hotdog/security/advisories/GHSA-jr96-7frv-3mpj"}]}, "source": {"discovery": "EXTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T23:18:41.548Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://unit42.paloaltonetworks.com/aws-log4shell-hot-patch-vulnerabilities"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/bottlerocket-os/hotdog/security/advisories/GHSA-jr96-7frv-3mpj"}]}]}, "cveMetadata": {"assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0", "assignerShortName": "palo_alto", "cveId": "CVE-2022-0071", "datePublished": "2022-04-19T22:15:25.022600Z", "dateReserved": "2021-12-28T00:00:00", "dateUpdated": "2024-09-17T04:24:20.485Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:hotdog_project:hotdog:*:*:*:*:*:java:*:*", "matchCriteriaId": "CADEE0F5-5A6C-4970-8819-AE8FCCE1B066", "versionEndExcluding": "1.0.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Incomplete fix for CVE-2021-3101. Hotdog, prior to v1.0.2, did not mimic the resource limits, device restrictions, or syscall filters of the target JVM process. This would allow a container to exhaust the resources of the host, modify devices, or make syscalls that would otherwise be blocked."}, {"lang": "es", "value": "Una correcci\u00f3n incompleta de CVE-2021-3101. Hotdog, versiones anteriores a v1.0.2, no imitaba los l\u00edmites de recursos, las restricciones de dispositivos o los filtros de syscall del proceso JVM de destino. Esto permit\u00eda a un contenedor agotar los recursos del host, modificar dispositivos o realizar syscalls que de otro modo estar\u00edan bloqueados"}], "id": "CVE-2022-0071", "lastModified": "2022-04-29T17:27:03.247", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.2, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.0, "impactScore": 6.0, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.0, "impactScore": 6.0, "source": "psirt@paloaltonetworks.com", "type": "Secondary"}]}, "published": "2022-04-19T23:15:13.243", "references": [{"source": "psirt@paloaltonetworks.com", "tags": ["Third Party Advisory"], "url": "https://github.com/bottlerocket-os/hotdog/security/advisories/GHSA-jr96-7frv-3mpj"}, {"source": "psirt@paloaltonetworks.com", "tags": ["Exploit", "Patch", "Third Party Advisory"], "url": "https://unit42.paloaltonetworks.com/aws-log4shell-hot-patch-vulnerabilities"}], "sourceIdentifier": "psirt@paloaltonetworks.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-269"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-250"}], "source": "psirt@paloaltonetworks.com", "type": "Secondary"}]}