CVE-2023-26031: 
Java vulnerability analysis and mitigation

CVE-2023-26031 affects Apache Hadoop versions 3.3.1 to 3.3.4 on Linux systems, involving a vulnerability in the relative library resolution of the container-executor binary. The vulnerability was discovered on July 13, 2022, and publicly announced on November 16, 2023. This security flaw allows local users to gain root privileges, and in certain configurations where YARN clusters accept remote authenticated users' work, it may enable remote users to obtain root privileges (Apache CVE List, NVD).

The vulnerability stems from a modification introduced in YARN-10495 that changed the library loading path for .so files from '$ORIGIN/' to '$ORIGIN/:../lib/native/'. This path is used to locate libcrypto.so. The container-executor binary, which must be owned by root and have the suid bit set for YARN processes to run containers as specific users, can be exploited through this modified library path. The vulnerability has a CVSS v3.1 base score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD, NetApp Advisory).

When successfully exploited, this vulnerability allows users with reduced privileges to install a malicious libcrypto library into a writable path, invoke the container-executor command, and have their modified library executed with root privileges. In environments where YARN clusters accept remote authenticated users' jobs executed on the physical host rather than in containers, the vulnerability enables remote users to gain root privileges (Security Online, NVD).

The vulnerability is exploitable when the container-executor binary has specific configurations. To be vulnerable, the system must have the RUNPATH or RPATH value containing the relative path './lib/native/', and the container-executor must be owned by root with the suid bit set. This can be verified using the readelf command to check the binary's configuration (Apache CVE List).

The vulnerability has been fixed in Apache Hadoop version 3.3.5 through YARN-11441, which reverts the changes made in YARN-10495. For systems that cannot immediately upgrade, a temporary mitigation involves either disabling the container-executor by removing execute permissions, changing its ownership from root, or deleting it if Yarn Secure Containers are not required. Alternatively, the container-executor binary can be replaced with that from version 3.3.5 (Apache CVE List, YARN-11441).