CISA issues emergency directive to fix Log4j vulnerability

Federal agencies have a week to get their systems patched

The US government's Cybersecurity and Infrastructure Security Agency (CISA) on Friday escalated its call to fix the Apache Log4j vulnerability with an emergency directive requiring federal agencies to take corrective action by 5 pm EST on December 23, 2021.

Log4j is a Java-based open source logging library used in millions of applications. Versions up to and including 2.14.1 contain a critical remote code execution flaw (CVE-2021-44228), and the fix incorporated into version 2.15, released a week ago, has since been bypassed.

The software library includes a text-formatting language that allows code execution and the vulnerability enables a remote attacker to craft a string like ${jndi:ldap://} to fetch the referenced object on the specified server and execute it.

The flaw, referred to as Log4Shell or Logjam, is rated Critical – with a CVSS score of 10.0 – and is already being actively exploited, hence the hullabaloo.

"Since Log4Shell is a critical flaw with a huge attack surface and is very simple to exploit, threat actors are actively using it to launch their attacks even with a patch already released, said Felipe Tarijon, a malware analyst at Appgate, in an email to The Register. "Several state-sponsored groups are exploiting the flaw in the wild and making modifications to the Log4j exploit."

Tarijon said botnets Muhstik and a Mirai-variant were abusing the flaw on Linux devices before public disclosure, and exploitation activities like the deployment of cryptocurrency miners have been observed. He added that a new ransomware family targeting Windows named Khonsari has been seen exploiting the Log4j vulnerability, which has also been used to deliver the Orcus Remote Access Trojan.

"This vulnerability, which is being widely exploited by a growing set of threat actors, presents an urgent challenge to network defenders given its broad use," said CISA Director Jen Easterly in a statement last week. "End users will be reliant on their vendors, and the vendor community must immediately identify, mitigate, and patch the wide array of products using this software."

CISA earlier this week published mitigation guidance directing federal civilian agencies to update Log4j to version 2.15 by December 24, 2021, to address CVE-2021-44228.

But on Wednesday that advice was superseded with the recommendation that affected entities update to version 2.16, released two days earlier to address a mitigation bypass and a separate flaw that had been identified, CVE-2021-45046, that allows an attacker to conduct a denial-of-service attack on affected devices via malicious payloads.

The emergency directive requires federal civilian agencies by the end of the business day on December 23rd to: 1) Identify all systems that accept data over the internet; to check those systems against the CISA-managed GitHub repository; apply the latest Log4j patch if appropriate or take vulnerable systems offline; submit a pull request identifying assets not referenced; and assume that vulnerable systems have been compromised, with the post-incident investigation and mitigation that entails.

And by 5 pm EST on December 28, 2021, agencies are required to report systems they identified during this process and to detail whatever action was taken.

The fire drill, however, may not be over yet. The volunteer maintainers of Log4j have identified an infinite recursion bug, affecting versions up through 2.16, that apparently will crash the application if string substitution is attempted on this string pattern ${${::-${::-$${::-j}}}}.

As this article was filed, there's not yet public agreement about whether this constitutes a meaningful denial-of-service attack risk or about whether a CVE will be sought for the issue. Stay tuned.

"The first patch (2.15) still has a vulnerability in non-default configurations allowing exfiltration of sensitive data," said Tarijon in an email to The Register. "So, applying the latest patch by updating to 2.16 would be enough to fix the remote code execution (RCE) problem. It disables JNDI, the component abused to leverage the RCE.

The recursion bug in version 2.16, he said, appears to be less critical because it can only be used for a denial of service attack that crashes the log system. Though the RCE bug has been patched in 2.16, he expects it will continue to have a significant impact because of the huge attack surface that depends upon vendors and third parties who may not apply patches quickly enough.

"As a reference, the PrintSpooler vulnerabilities in July of this year led to an RCE bug, patched by Microsoft, but subsequent exploits and variants appeared later as soon as threat actors started to abuse the vulnerability in the wild," Tarijon explained.

In other words, expect to keep hearing about Log4j. ®

Broader topics

Other stories you might like

  • VMware claims 'bare-metal' performance from virtualized Nvidia GPUs
    Is... is that why Broadcom wants to buy it?

    The future of high-performance computing will be virtualized, VMware's Uday Kurkure has told The Register.

    Kurkure, the lead engineer for VMware's performance engineering team, has spent the past five years working on ways to virtualize machine-learning workloads running on accelerators. Earlier this month his team reported "near or better than bare-metal performance" for Bidirectional Encoder Representations from Transformers (BERT) and Mask R-CNN — two popular machine-learning workloads — running on virtualized GPUs (vGPU) connected using Nvidia's NVLink interconnect.

    NVLink enables compute and memory resources to be shared across up to four GPUs over a high-bandwidth mesh fabric operating at 6.25GB/s per lane compared to PCIe 4.0's 2.5GB/s. The interconnect enabled Kurkure's team to pool 160GB of GPU memory from the Dell PowerEdge system's four 40GB Nvidia A100 SXM GPUs.

    Continue reading
  • Nvidia promises annual datacenter product updates across CPU, GPU, and DPU
    Arm one year, x86 the next, and always faster than a certain chip shop that still can't ship even one standalone GPU

    Computex Nvidia's push deeper into enterprise computing will see its practice of introducing a new GPU architecture every two years brought to its CPUs and data processing units (DPUs, aka SmartNICs).

    Speaking on the company's pre-recorded keynote released to coincide with the Computex exhibition in Taiwan this week, senior vice president for hardware engineering Brian Kelleher spoke of the company's "reputation for unmatched execution on silicon." That's language that needs to be considered in the context of Intel, an Nvidia rival, again delaying a planned entry to the discrete GPU market.

    "We will extend our execution excellence and give each of our chip architectures a two-year rhythm," Kelleher added.

    Continue reading
  • Now Amazon puts 'creepy' AI cameras in UK delivery vans
    Big Bezos is watching you

    Amazon is reportedly installing AI-powered cameras in delivery vans to keep tabs on its drivers in the UK.

    The technology was first deployed, with numerous errors that reportedly denied drivers' bonuses after malfunctions, in the US. Last year, the internet giant produced a corporate video detailing how the cameras monitor drivers' driving behavior for safety reasons. The same system is now apparently being rolled out to vehicles in the UK. 

    Multiple camera lenses are placed under the front mirror. One is directed at the person behind the wheel, one is facing the road, and two are located on either side to provide a wider view. The cameras are monitored by software built by Netradyne, a computer-vision startup focused on driver safety. This code uses machine-learning algorithms to figure out what's going on in and around the vehicle.

    Continue reading

Biting the hand that feeds IT © 1998–2022