CVE-2021-3283: 
Nomad vulnerability analysis and mitigation

HashiCorp Nomad and Nomad Enterprise, identified as CVE-2021-3283, contained a vulnerability in their exec and java task drivers that could allow access to processes associated with other tasks on the same node. The vulnerability affected all versions up to 0.12.9 and was fixed in versions 0.12.10 and 1.0.3. This security issue was discovered and disclosed on January 29, 2021 (HashiCorp Advisory).

The vulnerability stemmed from ineffective isolation mechanisms within Nomad's exec and java task drivers. The issue received a CVSS v3.1 base score of 7.5 (HIGH) with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating high confidentiality impact with network accessibility (NVD).

The vulnerability allowed malicious Nomad tasks to access information about processes associated with other tasks running on the same node. This included potential exposure of sensitive information such as command lines and environment variables (HashiCorp Advisory).

The vulnerability could be exploited by a malicious task to gain unauthorized access to process information of other tasks on the same node. Third-party task drivers using the shared library for the exec and java drivers may also be exposed (HashiCorp Advisory).

To address this vulnerability, HashiCorp implemented PID and IPC namespacing for the exec and java task drivers. Users should upgrade to Nomad or Nomad Enterprise version 0.12.10, 1.0.3, or newer. Alternatively, disabling the exec and java drivers is sufficient to prevent this vulnerability. The docker task driver was not affected by this issue (HashiCorp Advisory).