Azure Linux Agent Information Disclosure Vulnerability

2019-03-1407:00:00

Microsoft

msrc.microsoft.com

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS

0.003

Percentile

68.6%

JSON

An information disclosure vulnerability exists in the way Azure WaLinuxAgent creates swap files on resource disks. An authenticated attacker who successfully exploited this vulnerability could view data in swap that is normally hidden.

None of the Azure endorsed distros are vulnerable to this issue by default, but this can occur on customer customized or modified images when swapfile is created by the Azure linux agent and python3 is enabled as the default python version.

This update addresses this vulnerability by preventing how the swap information is accessed.