CVE-2022-29527
High
Description
Amazon AWS amazon-ssm-agent before 3.1.1208.0 creates a world-writable sudoers file, which allows local attackers to inject Sudo rules and escalate privileges to root. This occurs in certain situations involving a race condition.
SeverityHigh
CVSS7.0
Exploit probability—
ProductAmazon Ssm Agent
PublishedApr 20, 2022
First seenApr 20, 2022
How to fix
Update
- amazon amazon_ssm_agent3.1.1208.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| amazon amazon_ssm_agent | v < 3.1.1208.0 | 3.1.1208.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.