Privilege Escalation Vulnerability in Apache Hadoop by The Apache Software Foundation

CVE-2017-7669

Summary

In specific versions of Apache Hadoop, particularly 2.8.0 and alpha releases of 3.0.0, the LinuxContainerExecutor is designed to run Docker commands with root privileges. However, the implementation suffers from a lack of adequate input validation, allowing authenticated users to execute arbitrary commands as the root user when the Docker feature is enabled. This vulnerability highlights significant security concerns for installations running these versions, as it may lead to unauthorized access and control over system resources.

References