CVE-2021-36795
📋 TL;DR
A permission issue in the Cohesity Linux agent allows local privilege escalation. An underprivileged Linux user can gain additional privileges if certain environmental conditions are met. Affects Cohesity Linux agent versions 6.5.1b through 6.5.1d-hotfix10 and 6.6.0a through 6.6.0b-hotfix1.
💻 Affected Systems
- Cohesity Linux Agent
📦 What is this software?
Linux Agent by Cohesity
Linux Agent by Cohesity
Linux Agent by Cohesity
Linux Agent by Cohesity
⚠️ Risk & Real-World Impact
Worst Case
An attacker gains root privileges on the system, enabling complete system compromise, data theft, and lateral movement.
Likely Case
Local users escalate privileges to perform unauthorized administrative actions or access restricted data.
If Mitigated
Limited impact if proper access controls and monitoring are in place to detect privilege escalation attempts.
🎯 Exploit Status
Exploitation requires local user access and specific environmental conditions.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 6.5.1d-hotfix10 and 6.6.0b-hotfix1
Vendor Advisory: https://github.com/cohesity/SecAdvisory/blob/master/CVE-2021-36795.md
Restart Required: Yes
Instructions:
1. Update Cohesity Linux agent to version 6.5.1d-hotfix11 or later for 6.5.x branch. 2. Update to version 6.6.0b-hotfix2 or later for 6.6.x branch. 3. Restart the agent service after update.
🔧 Temporary Workarounds
Restrict Local User Access
linuxLimit local user accounts on systems running Cohesity Linux agent to reduce attack surface.
# Review and remove unnecessary local users
# Use 'userdel' command to remove users
# Implement least privilege access controls
🧯 If You Can't Patch
- Implement strict access controls to limit local user privileges.
- Monitor system logs for privilege escalation attempts and unauthorized access.
🔍 How to Verify
Check if Vulnerable:
Check Cohesity agent version using 'cohesity-agent --version' or similar command and compare against affected versions.Check Version:
cohesity-agent --versionVerify Fix Applied:
Verify agent version is updated to patched version and test privilege escalation attempts fail.📡 Detection & Monitoring
Log Indicators:
- Unexpected privilege escalation events
- Failed or successful sudo/su attempts from non-admin users
- Cohesity agent service restarts or permission changes
Network Indicators:
- None - this is a local privilege escalation vulnerability
SIEM Query:
Search for events where user privilege level changes unexpectedly or Cohesity agent processes spawn with elevated privileges.