CVE-2022-0070: 
Amazon Linux vulnerability analysis and mitigation

CVE-2022-0070 is a security vulnerability discovered in AWS's Log4j hotpatch solution, which was initially released to address the critical Log4Shell vulnerability. The issue was identified in the Apache Log4j hotpatch package versions prior to log4j-cve-2021-44228-hotpatch-1.1-16. The vulnerability was disclosed on April 19, 2022, and affects systems where the AWS Log4j hotpatch was installed, including Amazon Linux 1 and Amazon Linux 2 environments (AWS Security Bulletin).

The vulnerability stems from improper privilege management in the hotpatch service. The service was designed to search for Java processes and patch them against Log4Shell on the fly, but it failed to properly containerize the execution of container binaries. When the hotpatch service invoked container binaries, it did so without properly applying container limitations, running them with all Linux capabilities and without proper isolation technologies like seccomp and cgroups. The vulnerability received a CVSS v3.1 base score of 8.8 (High) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H (NVD).

The vulnerability could allow container escape and privilege escalation, enabling attackers to take control of the underlying host system. Any container in the affected environment could potentially exploit the hotpatch to escape its containment, regardless of whether they run Java applications or whether their underlying host runs Bottlerocket. The issue affected containers running with user namespaces or as non-root users, and unprivileged processes could exploit the patch to escalate privileges and gain root code execution (Unit42 Report).

AWS released fixed versions for all affected components on April 19, 2022. The remediation includes updating to version 1.1-16 of the log4j-cve-2021-44228-hotpatch package for Amazon Linux and Amazon Linux 2. Users can upgrade by running 'yum update log4j-cve-2021-44228-hotpatch'. Alternatively, if environments are already patched against Log4Shell, users can disable the hot patch service by running 'sudo touch /etc/log4j-cve-2021-44228-hotpatch.kill' (AWS Security Bulletin).