-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.hadoop:hadoop-yarn-project | maven | >= 3.3.1, < 3.3.5 | 3.3.5 |
Miggo AIRoot Cause AnalysisThe vulnerability arises from the RPATH configuration in the CMake build script. The YARN-10495 patch introduced an RPATH entry for '$ORIGIN/:../lib/native/', which allows the container-executor binary to search for shared libraries in a relative path ('../lib/native/'). This path is writable by unprivileged users, enabling them to place a malicious libcrypto.so and escalate privileges when the SUID-root binary loads it. The CMakeLists.txt modifications in the commit diff explicitly set the INSTALL_RPATH property with this insecure value. The revert in YARN-11441 removed these RPATH configurations, confirming their role in the vulnerability.
JavaJava$ ls -laF /opt/hadoop/bin/container-executor ---Sr-s---. 1 root hadoop 802968 May 9 20:21 /opt/hadoop/bin/container-executor
A safe installation lacks the suid bit; ideally is also not owned by root.
$ ls -laF /opt/hadoop/bin/container-executor -rwxr-xr-x. 1 yarn hadoop 802968 May 9 20:21 /opt/hadoop/bin/container-executor
This configuration does not support Yarn Secure Containers, but all other hadoop services, including YARN job execution outside secure containers continue to work.