Skip to content
OpenAdvisories
High MSRC-CVE-2022-30137 1 CVE

Azure Service Fabric Container Elevation of Privilege Vulnerability

Published Jun 14, 2022 · Updated Jun 17, 2022 · Revision 3

Vendor: Microsoft

Summary

Impact: Elevation of Privilege. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

According to the CVSS metric, privileges required is high (PR:H). What would lead to a successful attack?
In order for the successful attack to be initiated, the attacker would need to have read/write access to the cluster and the ability to execute the hostile code inside a container that has been granted access to the Service Fabric runtime.

What is being fixed in CVE-2022-30137?
Azure Service Fabric team is releasing a patch to further strengthen the security in the Linux cluster by adapting the principle of path to least privilege. Windows cluster are NOT impacted by this vulnerability.
Customers without automatic updates enabled should upgrade their Linux clusters to the most recent Service Fabric release. Customers whose Linux clusters are automatically updated do not need to take further action.
We have also updated our public security guidance to include details regarding the implications of hosting untrusted code or having one’s containers compromised. Please see the information here: Hosting untrusted applications in a Service Fabric cluster

Vulnerabilities 1

  • Medium 6.7
    CVE-2022-30137

    Azure Service Fabric Container Elevation of Privilege Vulnerability

    Executive Summary An Elevation of Privilege (EOP) vulnerability has been identified within Service Fabric clusters that run Docker containers. Exploitation of this EOP vulnerability requires an attacker to gain remote code execution within a container. All Se…

    Microsoft Service Fabric

Revision history

  1. #3

    Updated CVE to change the name Azure Service Fabric to Service Fabric as the product is not specific to Azure. This is an informational change only.

  2. #1

    Information published.

  3. #2

    Updated FAQ information. This is an informational change only.

References