CVE-2022-0071 HIGH

CVE-2022-0071: Hotdog Container Escape

Vendor Amazon Web Services
Product Hotdog
Weakness CWE-250
Published April 19, 2022
Last update September 17, 2024

CVSS base score

8.8/10
Attack vector Local
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

Incomplete fix for CVE-2021-3101. Hotdog, prior to v1.0.2, did not mimic the resource limits, device restrictions, or syscall filters of the target JVM process. This would allow a container to exhaust the resources of the host, modify devices, or make syscalls that would otherwise be blocked.

Key dates

02Disclosure timeline

April 19, 2022 CVE published
September 17, 2024 Record updated