CVE-2022-0070
📋 TL;DR
This vulnerability is an incomplete fix for CVE-2021-3100 in Apache Log4j hotpatch packages. It allows attackers to escalate privileges by exploiting the hotpatch's failure to properly mimic Linux capabilities and cgroups of the target Java process. Organizations using AWS's Log4j hotpatch for Log4Shell mitigation are affected.
💻 Affected Systems
- Apache Log4j hotpatch package
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with root privileges, allowing complete control over the affected server and potential lateral movement across the network.
Likely Case
Privilege escalation to root on the vulnerable system, enabling installation of backdoors, data theft, or further exploitation.
If Mitigated
Limited impact with proper isolation and least privilege controls, potentially containing the escalation to the affected container or process.
🎯 Exploit Status
Exploitation requires initial access to the system, but privilege escalation is straightforward once the hotpatch is applied.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Updated hotpatch versions from AWS
Vendor Advisory: https://alas.aws.amazon.com/cve/html/CVE-2022-0070.html
Restart Required: No
Instructions:
1. Check current hotpatch version. 2. Update to the latest AWS-provided hotpatch. 3. Verify the hotpatch properly mimics Linux capabilities and cgroups. 4. Consider removing the hotpatch entirely if Log4j has been updated to a secure version.
🔧 Temporary Workarounds
Remove hotpatch and update Log4j
linuxRemove the vulnerable hotpatch and update Log4j to a patched version (2.17.0 or later) to address Log4Shell directly.
# Remove hotpatch package
# Update Log4j to version 2.17.0 or later
Isolate affected systems
allApply network segmentation and strict access controls to limit potential impact if exploitation occurs.
🧯 If You Can't Patch
- Apply strict Linux capabilities and cgroups controls to limit what the hotpatch can access.
- Monitor for privilege escalation attempts and unusual process behavior on systems with the hotpatch.
🔍 How to Verify
Check if Vulnerable:
Check if log4j-cve-2021-44228-hotpatch-1.1-16 or later is installed before the fixed version.Check Version:
rpm -qa | grep log4j-cve-2021-44228-hotpatchVerify Fix Applied:
Verify the hotpatch version has been updated to a version that properly handles Linux capabilities and cgroups.📡 Detection & Monitoring
Log Indicators:
- Unexpected privilege escalation events
- Hotpatch process spawning with elevated privileges
- Failed capability/cgroup mimic attempts
Network Indicators:
- Unusual outbound connections from systems with hotpatch
- Lateral movement attempts from affected systems
SIEM Query:
process_name:"hotpatch" AND (privilege_escalation OR failed_capability)