GCVE-110-CLOUD-2022-0035

Advisory Published

Vulnetix · Advisory published April 20, 2022

The Amazon SSM Agent (used for managing EC2 instances via Amazon Systems Manager) created a world-writable sudoers file, which would have allowed local attackers to inject Sudo rules and escalate privileges to root. This could occur in certain situations involving a race condition.

Download JSON Open in Console

Affected Products

Vendor	Product	Versions	Platforms
AWS	SSM	—	—
AWS	Cloud Services	—	—
AWS	SSM, EC2	—	—
AWS	EC2	—	—

Aliases

CVE-2022-29527

References

AWS SSM agent local privilege escalation

advisory

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON