CVE-2022-41606

Root

Cause The vulnerability lies in Nomad's artifact stanza, which uses HashiCorp's go-getter library to fetch artifacts from S3 or GCS. When a job is submitted with an invalid S3 or GCS URL, the go-getter library triggers a panic that crashes the Nomad client agent, rather than handling the error gracefully [1][4].

Exploitation

An attacker with authenticated access to submit jobs to a Nomad cluster can exploit this by crafting a job specification containing a malformed S3 or GCS URL in an artifact stanza. No special network position or additional privileges are required beyond the ability to submit jobs [4].

Impact

Successful exploitation causes the Nomad client agent to crash, resulting in a denial of service condition. This can disrupt workload execution and cluster stability, potentially affecting all jobs running on the targeted client node [4].

Mitigation

HashiCorp has addressed this issue in Nomad versions 1.2.13, 1.3.6, and 1.4.0 by modifying the go-getter integration to recover from panics during artifact retrieval. Users are strongly advised to upgrade to these versions or later to prevent exploitation [1][4].