// For flags

CVE-2023-26031

Privilege escalation in Apache Hadoop Yarn container-executor binary on Linux systems

Severity Score

7.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track*
*SSVC
Descriptions

Relative library resolution in linux container-executor binary in Apache Hadoop 3.3.1-3.3.4 on Linux allows local user to gain root privileges. If the YARN cluster is accepting work from remote (authenticated) users, this MAY permit remote users to gain root privileges.

Hadoop 3.3.0 updated the " YARN Secure Containers https://hadoop.apache.org/docs/stable/hadoop-yarn/hadoop-yarn-site/SecureContainer.html " to add a feature for executing user-submitted applications in isolated linux containers.

The native binary HADOOP_HOME/bin/container-executor is used to launch these containers; it must be owned by root and have the suid bit set in order for the YARN processes to run the containers as the specific users submitting the jobs.

The patch " YARN-10495 https://issues.apache.org/jira/browse/YARN-10495 . make the rpath of container-executor configurable" modified the library loading path for loading .so files from "$ORIGIN/" to ""$ORIGIN/:../lib/native/". This is the a path through which libcrypto.so is located. Thus it is is possible for a user with reduced privileges to install a malicious libcrypto library into a path to which they have write access, invoke the container-executor command, and have their modified library executed as root.
If the YARN cluster is accepting work from remote (authenticated) users, and these users' submitted job are executed in the physical host, rather than a container, then the CVE permits remote users to gain root privileges.

The fix for the vulnerability is to revert the change, which is done in YARN-11441 https://issues.apache.org/jira/browse/YARN-11441 , "Revert YARN-10495". This patch is in hadoop-3.3.5.

To determine whether a version of container-executor is vulnerable, use the readelf command. If the RUNPATH or RPATH value contains the relative path "./lib/native/" then it is at risk

$ readelf -d container-executor|grep 'RUNPATH\|RPATH'
0x000000000000001d (RUNPATH)           Library runpath: [$ORIGIN/:../lib/native/]

If it does not, then it is safe:

$ readelf -d container-executor|grep 'RUNPATH\|RPATH'
0x000000000000001d (RUNPATH)           Library runpath: [$ORIGIN/]

For an at-risk version of container-executor to enable privilege escalation, the owner must be root and the suid bit must be set

$ ls -laF /opt/hadoop/bin/container-executor
---Sr-s---. 1 root hadoop 802968 May 9 20:21 /opt/hadoop/bin/container-executor

A safe installation lacks the suid bit; ideally is also not owned by root.

$ ls -laF /opt/hadoop/bin/container-executor
-rwxr-xr-x. 1 yarn hadoop 802968 May 9 20:21 /opt/hadoop/bin/container-executor

This configuration does not support Yarn Secure Containers, but all other hadoop services, including YARN job execution outside secure containers continue to work.

La resolución relativa de la librería en el binario contenedor-ejecutor de Linux en Apache Hadoop 3.3.1-3.3.4 en Linux permite al usuario local obtener privilegios de root. Si el clúster YARN acepta trabajo de usuarios remotos (autenticados), esto PUEDE permitir que los usuarios remotos obtengan privilegios de root. Hadoop 3.3.0 actualizó " YARN Secure Containers https://hadoop.apache.org/docs/stable/hadoop-yarn/hadoop-yarn-site/SecureContainer.html " para agregar una función para ejecutar aplicaciones enviadas por el usuario de forma aislada contenedores de Linux. El binario nativo HADOOP_HOME/bin/container-executor se utiliza para lanzar estos contenedores; debe ser propiedad de root y tener el bit suid configurado para que los procesos YARN ejecuten los contenedores como los usuarios específicos que envían los trabajos. El parche "YARN-10495 https://issues.apache.org/jira/browse/YARN-10495. make the rpath of container-executor configurable" modificó la ruta de carga de la librería para cargar archivos .so de "$ORIGIN/" a ""$ORIGIN/:../lib/native/". Esta es la ruta a través de la cual se encuentra libcrypto.so. Por lo tanto, es posible que un usuario con privilegios reducidos instale una librería libcrypto maliciosa en una ruta a la que tienen acceso de escritura, invocan el comando contenedor-ejecutor y ejecutan su librería modificada como root. Si el clúster YARN acepta trabajo de usuarios remotos (autenticados) y el trabajo enviado por estos usuarios se ejecuta en el host físico, en lugar de un contenedor, entonces el CVE permite a los usuarios remotos obtener privilegios de root. La solución para la vulnerabilidad es revertir el cambio, lo cual se realiza en YARN-11441 https://issues.apache.org/jira/browse/YARN-11441, "Revertir YARN-10495". Este parche está en hadoop-3.3.5. Para determinar si una versión de container-executor es vulnerable, utilice el comando readelf. Si el valor RUNPATH o RPATH contiene la ruta relativa "./lib/native/", entonces está en riesgo $ readelf -d container-executor|grep 'RUNPATH\|RPATH' 0x0000000000000001d (RUNPATH) Ruta de ejecución de la librería: [$ORIGIN/: ../lib/native/] Si no es así, entonces es seguro: $ readelf -d container-executor|grep 'RUNPATH\|RPATH' 0x000000000000001d (RUNPATH) Ruta de ejecución de la librería: [$ORIGIN/] Para un sitio en riesgo versión de container-executor para habilitar la escalada de privilegios, el propietario debe ser root y el bit suid debe estar configurado $ ls -laF /opt/hadoop/bin/container-executor ---Sr-s---. 1 root hadoop 802968 9 de mayo 20:21 /opt/hadoop/bin/container-executor Una instalación segura carece del bit suid; Lo ideal es que tampoco sea propiedad de root. $ ls -laF /opt/hadoop/bin/container-executor -rwxr-xr-x. 1 hilo hadoop 802968 9 de mayo 20:21 /opt/hadoop/bin/container-executor Esta configuración no admite Contenedores Seguros Yarn, pero todos los demás servicios de hadoop, incluida la ejecución de trabajos YARN fuera de contenedores seguros, continúan funcionando.

*Credits: Esa Hiltunen, Mikko Kortelainen, The Teragrep Project
CVSS Scores
Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
* Common Vulnerability Scoring System
SSVC
  • Decision:Track*
Exploitation
None
Automatable
No
Tech. Impact
Total
* Organization's Worst-case Scenario
Timeline
  • 2023-02-17 CVE Reserved
  • 2023-11-16 CVE Published
  • 2024-05-23 EPSS Updated
  • 2024-08-02 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-426: Untrusted Search Path
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Apache
Search vendor "Apache"
Hadoop
Search vendor "Apache" for product "Hadoop"
>= 3.3.1 <= 3.3.4
Search vendor "Apache" for product "Hadoop" and version " >= 3.3.1 <= 3.3.4"
-
Affected