Improper access control in vm2 - CVE-2022-36067
Published: September 13, 2022 / Updated: April 11, 2023
Vulnerability identifier: #VU67205
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-36067
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerability details
The vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to improper access restrictions. A remote attacker can bypass the sandbox protections and execute arbitrary code on the host running the sandbox.
Affected software
vm2
Cloud Pak for Security (CP4S)
Multicluster Engine for Kubernetes
Red Hat Advanced Cluster Management for Kubernetes
IBM Cloud Pak for Watson AIOps
Cloud Pak for Security (CP4S)
Multicluster Engine for Kubernetes
Red Hat Advanced Cluster Management for Kubernetes
IBM Cloud Pak for Watson AIOps
How to mitigate CVE-2022-36067
Install updates from vendor's website.
vm2 - update to 3.9.11
Cloud Pak for Security (CP4S) - update to 1.10.7.0
Multicluster Engine for Kubernetes - addressed in versions 2.0.2, 2.1.1
Red Hat Advanced Cluster Management for Kubernetes - addressed in versions 2.4.6, 2.5.2, 2.6.1
IBM Cloud Pak for Watson AIOps - update to 3.6.0
Cloud Pak for Security (CP4S) - update to 1.10.7.0
Multicluster Engine for Kubernetes - addressed in versions 2.0.2, 2.1.1
Red Hat Advanced Cluster Management for Kubernetes - addressed in versions 2.4.6, 2.5.2, 2.6.1
IBM Cloud Pak for Watson AIOps - update to 3.6.0
Links to Public Exploits and PoC-codes
External References
- https://github.com/patriksimek/vm2/commit/d9a7f3cc995d3d861e1380eafb886cb3c5e2b873#diff-b1a515a627d820118e76d0e323fe2f0589ed50a1eacb490f6c3278fe3698f164
- https://github.com/patriksimek/vm2/issues/467
- https://github.com/patriksimek/vm2/blob/master/lib/setup-sandbox.js#L71
- https://github.com/patriksimek/vm2/security/advisories/GHSA-mrgp-mrhc-5jrq
Related Security Bulletins
- Remote code execution in vm2 for Node.js
- Remote code execution in Red Hat Advanced Cluster Management
- Remote code execution in Multicluster Engine for Kubernetes 2.1
- Multiple vulnerabilities in Multicluster Engine for Kubernetes
- Multiple vulnerabilities in Red Hat Advanced Cluster Management 2.5
- Multiple vulnerabilities in Red Hat Advanced Cluster Management 2.4
- Multiple vulnerabilities in IBM Cloud Pak for Watson AIOps
- Multiple vulnerabilities in IBM Cloud Pak for Security (CP4S)