Vulnerability · Published Apr 20, 2022 · Assigned by mitre

CVE-2022-29527

High 7.0

In plain English

A high-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).

Severity (CVSS NVD)7.0High

Exploit odds (30 days)0.3%top 77.1% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Amazon AWS amazon-ssm-agent before 3.1.1208.0 creates a world-writable sudoers file, which allows local attackers to inject Sudo rules and escalate privileges to root. This occurs in certain situations involving a race condition.

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/aws/amazon-ssm-agent/releases/tag/3.1.1208.0 x_refsource_MISC
https://github.com/aws/amazon-ssm-agent/commit/0fe8ae99b2ff25649c7b86d3bc05fc037400aca7 x_refsource_MISC
https://bugzilla.suse.com/show_bug.cgi?id=1196556 x_refsource_MISC