CVE-2021-20264
📋 TL;DR
This vulnerability allows attackers with access to openjdk containers to modify the /etc/passwd file, enabling privilege escalation. It affects openjdk-1.8 and openjdk-11 containers, potentially compromising confidentiality, integrity, and availability. Containerized applications using these vulnerable images are at risk.
💻 Affected Systems
- openjdk-1.8 containers
- openjdk-11 containers
📦 What is this software?
Openjdk by Oracle
Openjdk by Oracle
⚠️ Risk & Real-World Impact
Worst Case
Full container compromise leading to host escape, data exfiltration, and lateral movement within the environment.
Likely Case
Container takeover allowing unauthorized access to application data and potential service disruption.
If Mitigated
Limited impact due to container isolation, minimal privileges, and proper security controls.
🎯 Exploit Status
Requires existing access to container, but exploitation is straightforward once access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Updated container images from Red Hat and other vendors
Vendor Advisory: https://bugzilla.redhat.com/show_bug.cgi?id=1932283
Restart Required: Yes
Instructions:
1. Pull updated container images from your registry. 2. Rebuild and redeploy affected containers. 3. Verify /etc/passwd permissions are correct.
🔧 Temporary Workarounds
Secure /etc/passwd permissions
linuxSet immutable permissions on /etc/passwd to prevent modifications
chattr +i /etc/passwd
Run containers with minimal privileges
linuxUse non-root users and drop capabilities
docker run --user 1000:1000 --cap-drop=ALL image:tag
🧯 If You Can't Patch
- Implement strict container runtime security policies
- Monitor for /etc/passwd modification attempts and container privilege escalation
🔍 How to Verify
Check if Vulnerable:
Check if running vulnerable openjdk container images and verify /etc/passwd file permissionsCheck Version:
docker images | grep openjdk && java -versionVerify Fix Applied:
Verify container image version is updated and /etc/passwd has correct immutable permissions📡 Detection & Monitoring
Log Indicators:
- Unexpected modifications to /etc/passwd
- Container privilege escalation attempts
- User account creation in containers
Network Indicators:
- Unusual outbound connections from containers
SIEM Query:
source="container_logs" AND ("passwd modification" OR "privilege escalation")