CVE-2023-26031
📋 TL;DR
This vulnerability allows local users to escalate privileges to root by exploiting relative library resolution in Apache Hadoop's container-executor binary. Remote authenticated users can also gain root access if the YARN cluster accepts their work. Affects Hadoop installations using YARN Secure Containers on Linux systems.
💻 Affected Systems
- Apache Hadoop
📦 What is this software?
Hadoop by Apache
⚠️ Risk & Real-World Impact
Worst Case
Remote authenticated attacker gains full root access to the Hadoop host, enabling complete system compromise, data theft, and lateral movement.
Likely Case
Local user or compromised service account escalates to root privileges, potentially compromising the entire Hadoop cluster and sensitive data.
If Mitigated
Attack fails due to proper file permissions or container isolation, but system remains vulnerable to other attack vectors.
🎯 Exploit Status
Exploitation requires write access to a directory in the library search path and ability to execute container-executor.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.3.5
Vendor Advisory: https://hadoop.apache.org/cve_list.html
Restart Required: Yes
Instructions:
1. Upgrade to Hadoop 3.3.5 or later. 2. Replace container-executor binary with patched version. 3. Restart all YARN services. 4. Verify SUID bit is removed if not using Secure Containers.
🔧 Temporary Workarounds
Remove SUID bit from container-executor
linuxDisables YARN Secure Containers but prevents privilege escalation
chmod u-s /path/to/hadoop/bin/container-executor
Change ownership to non-root user
linuxPrevents root execution while maintaining some functionality
chown yarn:hadoop /path/to/hadoop/bin/container-executor
🧯 If You Can't Patch
- Remove SUID bit from container-executor binary immediately
- Isolate Hadoop nodes from sensitive systems and implement strict access controls
🔍 How to Verify
Check if Vulnerable:
Run: readelf -d /path/to/hadoop/bin/container-executor | grep -E 'RUNPATH|RPATH' | grep -q '../lib/native/' && echo 'VULNERABLE'Check Version:
hadoop version | grep 'Hadoop'Verify Fix Applied:
Run: readelf -d /path/to/hadoop/bin/container-executor | grep -E 'RUNPATH|RPATH' | grep -q '../lib/native/' || echo 'PATCHED'📡 Detection & Monitoring
Log Indicators:
- Unusual library loading errors in YARN logs
- Suspicious container-executor executions with unexpected libraries
Network Indicators:
- Unusual outbound connections from Hadoop nodes post-exploitation
SIEM Query:
process_name:"container-executor" AND (library_load:"../lib/native/" OR parent_process:unusual_user)🔗 References
- https://hadoop.apache.org/cve_list.html
- https://issues.apache.org/jira/browse/YARN-11441
- https://lists.apache.org/thread/q9qpdlv952gb4kphpndd5phvl7fkh71r
- https://security.netapp.com/advisory/ntap-20240112-0001/
- https://hadoop.apache.org/cve_list.html
- https://issues.apache.org/jira/browse/YARN-11441
- https://lists.apache.org/thread/q9qpdlv952gb4kphpndd5phvl7fkh71r
- https://security.netapp.com/advisory/ntap-20240112-0001/
