CVE-2025-8904
BaseFortify
Publication date: 2025-08-13
Last updated on: 2025-10-14
Assigner: AMZN
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| amazon | emr | 6.10 |
| amazon | emr | 7.5 |
| amazon | emr | 7.4 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-257 | The storage of passwords in a recoverable format makes them subject to password reuse attacks by malicious users. In fact, it should be noted that recoverable encrypted passwords provide no significant benefit over plaintext passwords since they are subject not only to reuse by malicious attackers but also by malicious insiders. If a system administrator can recover a password directly, or use a brute force search on the available information, the administrator can use the password on other accounts. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs in the Amazon EMR Secret Agent component, which creates a keytab file containing Kerberos credentials and stores it in the /tmp/ directory. Because the /tmp/ directory is accessible to users with access to the system, an attacker who can access this directory and has another account could potentially decrypt the Kerberos keys. This could allow the attacker to escalate their privileges on the system. [1]
How can this vulnerability impact me? :
If exploited, this vulnerability can allow an attacker with access to the /tmp/ directory and another account to decrypt Kerberos credentials and escalate their privileges. This means the attacker could gain higher-level access than intended, potentially compromising the security and integrity of your Amazon EMR cluster and its data. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect this vulnerability by checking if your Amazon EMR cluster is running a version between 6.10 and 7.4 and if the /tmp/ directory contains a keytab file with Kerberos credentials created by the Amazon EMR Secret Agent. A possible command to find such files is: `ls -l /tmp/*.keytab` or `find /tmp/ -name '*.keytab'`. If such files exist and your EMR version is affected, the vulnerability is present. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation steps are to upgrade your Amazon EMR clusters to version 7.5 or higher, which removes the use of /tmp/ as a staging directory for Kerberos credentials. If upgrading immediately is not possible, apply the provided bootstrap script and RPM files containing the fix to your affected clusters as recommended by AWS. [1]