Search for vulnerabilities
Vulnerability details: VCID-mepu-6dey-kbby
Vulnerability ID VCID-mepu-6dey-kbby
Aliases CVE-2023-26031
GHSA-94jh-j374-9r3j
Summary Apache Hadoop allows local user to gain root privileges Relative library resolution in linux container-executor binary in Apache Hadoop 3.3.1-3.3.4 on Linux allows local user to gain root privileges. If the YARN cluster is accepting work from remote (authenticated) users, this MAY permit remote users to gain root privileges. Hadoop 3.3.0 updated the " YARN Secure Containers https://hadoop.apache.org/docs/stable/hadoop-yarn/hadoop-yarn-site/SecureContainer.html " to add a feature for executing user-submitted applications in isolated linux containers. The native binary HADOOP_HOME/bin/container-executor is used to launch these containers; it must be owned by root and have the suid bit set in order for the YARN processes to run the containers as the specific users submitting the jobs. The patch " YARN-10495 https://issues.apache.org/jira/browse/YARN-10495 . make the rpath of container-executor configurable" modified the library loading path for loading .so files from "$ORIGIN/" to ""$ORIGIN/:../lib/native/". This is the a path through which libcrypto.so is located. Thus it is is possible for a user with reduced privileges to install a malicious libcrypto library into a path to which they have write access, invoke the container-executor command, and have their modified library executed as root. If the YARN cluster is accepting work from remote (authenticated) users, and these users' submitted job are executed in the physical host, rather than a container, then the CVE permits remote users to gain root privileges. The fix for the vulnerability is to revert the change, which is done in YARN-11441 https://issues.apache.org/jira/browse/YARN-11441 , "Revert YARN-10495". This patch is in hadoop-3.3.5. To determine whether a version of container-executor is vulnerable, use the readelf command. If the RUNPATH or RPATH value contains the relative path "./lib/native/" then it is at risk $ readelf -d container-executor|grep 'RUNPATH\|RPATH' 0x000000000000001d (RUNPATH)           Library runpath: [$ORIGIN/:../lib/native/] If it does not, then it is safe: $ readelf -d container-executor|grep 'RUNPATH\|RPATH' 0x000000000000001d (RUNPATH)           Library runpath: [$ORIGIN/] For an at-risk version of container-executor to enable privilege escalation, the owner must be root and the suid bit must be set $ ls -laF /opt/hadoop/bin/container-executor ---Sr-s---. 1 root hadoop 802968 May 9 20:21 /opt/hadoop/bin/container-executor A safe installation lacks the suid bit; ideally is also not owned by root. $ ls -laF /opt/hadoop/bin/container-executor -rwxr-xr-x. 1 yarn hadoop 802968 May 9 20:21 /opt/hadoop/bin/container-executor This configuration does not support Yarn Secure Containers, but all other hadoop services, including YARN job execution outside secure containers continue to work.
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-426 Untrusted Search Path
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 7.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-26031.json
epss 0.12692 https://api.first.org/data/v1/epss?cve=CVE-2023-26031
cvssv3.1 7.5 https://github.com/apache/hadoop
generic_textual HIGH https://github.com/apache/hadoop
cvssv3.1 7.5 https://github.com/apache/hadoop/commit/10e7ca481c8cd0548d903d39d8581291e533bf12
generic_textual HIGH https://github.com/apache/hadoop/commit/10e7ca481c8cd0548d903d39d8581291e533bf12
cvssv3.1 7.5 https://github.com/apache/hadoop/commit/7d3c8ef6064efd132828765e52e961977aebbf47
generic_textual HIGH https://github.com/apache/hadoop/commit/7d3c8ef6064efd132828765e52e961977aebbf47
cvssv3.1 7.5 https://hadoop.apache.org/cve_list.html
generic_textual HIGH https://hadoop.apache.org/cve_list.html
ssvc Track https://hadoop.apache.org/cve_list.html
cvssv3.1 7.5 https://issues.apache.org/jira/browse/YARN-11441
generic_textual HIGH https://issues.apache.org/jira/browse/YARN-11441
ssvc Track https://issues.apache.org/jira/browse/YARN-11441
cvssv3.1 7.5 https://lists.apache.org/thread/q9qpdlv952gb4kphpndd5phvl7fkh71r
generic_textual HIGH https://lists.apache.org/thread/q9qpdlv952gb4kphpndd5phvl7fkh71r
ssvc Track https://lists.apache.org/thread/q9qpdlv952gb4kphpndd5phvl7fkh71r
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2023-26031
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2023-26031
cvssv3.1 7.5 https://security.netapp.com/advisory/ntap-20240112-0001
generic_textual HIGH https://security.netapp.com/advisory/ntap-20240112-0001
cvssv3.1 7.5 https://security.netapp.com/advisory/ntap-20240112-0001/
ssvc Track https://security.netapp.com/advisory/ntap-20240112-0001/
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-26031.json
https://api.first.org/data/v1/epss?cve=CVE-2023-26031
https://github.com/apache/hadoop
https://github.com/apache/hadoop/commit/10e7ca481c8cd0548d903d39d8581291e533bf12
https://github.com/apache/hadoop/commit/7d3c8ef6064efd132828765e52e961977aebbf47
https://hadoop.apache.org/cve_list.html
https://issues.apache.org/jira/browse/YARN-11441
https://lists.apache.org/thread/q9qpdlv952gb4kphpndd5phvl7fkh71r
https://nvd.nist.gov/vuln/detail/CVE-2023-26031
https://security.netapp.com/advisory/ntap-20240112-0001
2250137 https://bugzilla.redhat.com/show_bug.cgi?id=2250137
GHSA-94jh-j374-9r3j https://github.com/advisories/GHSA-94jh-j374-9r3j
ntap-20240112-0001 https://security.netapp.com/advisory/ntap-20240112-0001/
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-26031.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/apache/hadoop
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/apache/hadoop/commit/10e7ca481c8cd0548d903d39d8581291e533bf12
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/apache/hadoop/commit/7d3c8ef6064efd132828765e52e961977aebbf47
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://hadoop.apache.org/cve_list.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-07-19T03:55:27Z/ Found at https://hadoop.apache.org/cve_list.html
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://issues.apache.org/jira/browse/YARN-11441
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-07-19T03:55:27Z/ Found at https://issues.apache.org/jira/browse/YARN-11441
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://lists.apache.org/thread/q9qpdlv952gb4kphpndd5phvl7fkh71r
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-07-19T03:55:27Z/ Found at https://lists.apache.org/thread/q9qpdlv952gb4kphpndd5phvl7fkh71r
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2023-26031
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://security.netapp.com/advisory/ntap-20240112-0001
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://security.netapp.com/advisory/ntap-20240112-0001/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-07-19T03:55:27Z/ Found at https://security.netapp.com/advisory/ntap-20240112-0001/
Exploit Prediction Scoring System (EPSS)
Percentile 0.93637
EPSS Score 0.12692
Published At June 30, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-01T12:15:25.717216+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/11/GHSA-94jh-j374-9r3j/GHSA-94jh-j374-9r3j.json 36.1.3