Description

An OS command injection issue in the log4j-cve-2021-44228-hotpatch package in Amazon Linux before 1.3-9 might allow a local user to execute arbitrary commands with root privileges via a Java process whose executable path contains embedded newline characters.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-09-04T18:18:06.133Z",
  "pubdate": "2026-09-04T18:18:06.133Z",
  "executiveSummary": "This vulnerability is an OS command injection flaw identified in the log4j-cve-2021-44228-hotpatch package for Amazon Linux. The issue arises from improper handling of Java process executable paths containing newline characters, which can be weaponized by a local user to escalate privileges.\nBy manipulating the path of an executable, a local attacker can force the hotpatching utility to interpret malicious input as separate commands. This effectively grants the attacker the ability to execute arbitrary code with root-level privileges.\nThe vulnerability poses a severe risk to the integrity and confidentiality of the affected systems, as it bypasses standard security boundaries. Successful exploitation requires the attacker to have local access to the system. Once the specific condition regarding the Java process path is met, the attacker can hijack the execution flow of the hotpatch process. Organizations utilizing Amazon Linux with versions of log4j-cve-2021-44228-hotpatch prior to 1.3-9 are at risk and should prioritize immediate remediation to prevent privilege escalation.",
  "technicalDetails": "The vulnerability stems from an unsanitized command string construction within the log4j-cve-2021-44228-hotpatch utility. When the utility attempts to perform hotpatching operations on running Java processes, it inspects the process's executable path to identify target JVMs. The flaw exists because the utility does not properly validate or escape newline characters (\\n) present in these paths.\nThe exploitation flow begins with a local attacker identifying or creating a Java process where the file system path to the executable binary includes injected newline characters. When the log4j-cve-2021-44228-hotpatch script or binary iterates through the list of running processes to apply patches, it retrieves the command line information from the /proc filesystem. Because the utility fails to treat these retrieved paths as literal strings, the inclusion of a newline character allows the attacker to terminate the intended command context and initiate a new shell command.\nEssentially, the vulnerability acts as an injection vector where the shell environment executing the hotpatch utility interprets the input after the newline as a secondary, distinct command. Given that the log4j-cve-2021-44228-hotpatch utility typically runs with root privileges to interact with JVM memory spaces and process descriptors, any injected command is executed with the same elevated permissions.\nThe attack is characterized by the following steps: 1) The attacker prepares a malicious path, such as '/path/to/java\\n/bin/malicious_script', which appears in the process list. 2) The hotpatching utility parses the process list and captures this malformed path. 3) The utility executes a system call or shell command involving the path, inadvertently executing the attacker's secondary payload. 4) The injected command executes as root, allowing the attacker to perform arbitrary system modifications, bypass access controls, or install persistence mechanisms.\nThis vulnerability is strictly local, as it requires the ability to spawn or influence the naming of a process path on the host. It does not provide remote execution capabilities, but it represents a critical escalation path for unprivileged local users within the Amazon Linux environment. The component responsible is the logic within the hotpatcher that interfaces with the system shell to manage process state."
}