HashiCorp Nomad and Nomad Enterprise 0.9.2 through 1.0.17, 1.1.11, and 1.2.5 allow operators with read-fs and alloc-exec (or job-submit) capabilities to read arbitrary files on the host filesystem as root.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Nomad | Hashicorp | 0.9.2 (including) | 1.0.18 (excluding) |
| Nomad | Hashicorp | 1.1.0 (including) | 1.1.12 (excluding) |
| Nomad | Hashicorp | 1.2.0 (including) | 1.2.6 (excluding) |
| Nomad | Ubuntu | bionic | * |
| Nomad | Ubuntu | focal | * |
| Nomad | Ubuntu | trusty | * |
| Nomad | Ubuntu | xenial | * |
References
- https://discuss.hashicorp.com
- https://discuss.hashicorp.com/t/hcsec-2022-02-nomad-alloc-filesystem-and-container-escape/35560
- https://security.netapp.com/advisory/ntap-20220318-0008/
- https://discuss.hashicorp.com
- https://discuss.hashicorp.com/t/hcsec-2022-02-nomad-alloc-filesystem-and-container-escape/35560
- https://security.netapp.com/advisory/ntap-20220318-0008/