CVE-2022-29527

Vulnerability

In Amazon AWS amazon-ssm-agent versions before 3.1.1208.0, the createSudoersFileIfNotPresent function in agent/session/utility/utility_unix.go creates the sudoers file /etc/sudoers.d/ssm-agent-users using os.Create(), which sets the file mode to 0666 (world-writable) before a subsequent chmod to 0440 [1][2]. This creates a race window during which a local attacker can modify the file. The vulnerability occurs when the sudoers file does not already exist at the time of agent startup [1].

Exploitation

A local attacker must time their write operation to the sudoers file between its creation via os.Create() and the call to os.Chmod() that restricts permissions [1]. No authentication beyond local system access is required; the attacker simply needs to write malicious Sudo rules into the file during the race window. The attacker must be able to run code on the same machine as the agent [1][2].

Impact

Successful exploitation allows a local attacker to inject arbitrary Sudo rules, granting themselves passwordless root privileges on the system. The attacker can then execute any command with elevated privileges, leading to full compromise of the host [1].

Mitigation

The fix was released in version 3.1.1208.0 on 2022-04-04 [3]. The commit changes the file creation to use os.OpenFile with mode 0640 instead of 0666, eliminating the race condition by never creating a world-writable file [2]. Users should update to version 3.1.1208.0 or later. No workaround other than updating is documented.