CVE-2022-29527

Amazon AWS amazon-ssm-agent before 3.1.1208.0 creates a world-writable sudoers file, which allows local attackers to inject Sudo rules and escalate privileges to root. This occurs in certain situations involving a race condition.

• CWE-362
• CWE-732

• https://bugzilla.suse.com/show_bug.cgi?id=1196556Exploit, Issue Tracking, Third Party Advisory
• https://github.com/aws/amazon-ssm-agent/commit/0fe8ae99b2ff25649c7b86d3bc05fc037400aca7Patch, Third Party Advisory
• https://github.com/aws/amazon-ssm-agent/releases/tag/3.1.1208.0Patch, Release Notes, Third Party Advisory
• https://bugzilla.suse.com/show_bug.cgi?id=1196556Exploit, Issue Tracking, Third Party Advisory
• https://github.com/aws/amazon-ssm-agent/commit/0fe8ae99b2ff25649c7b86d3bc05fc037400aca7Patch, Third Party Advisory
• https://github.com/aws/amazon-ssm-agent/releases/tag/3.1.1208.0Patch, Release Notes, Third Party Advisory

Published

Apr 20, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-29520An OS command injection vulnerability exists in the console_…9.8
• CVE-2022-29522Use after free vulnerability exists in the simulator module …7.8
• CVE-2022-29523Improper conditions check in the Open CAS software maintaine…5.5
• CVE-2022-29524Out-of-bounds write vulnerability exists in V-Server v4.0.11…7.8
• CVE-2022-29525Rakuten Casa version AP_F_V1_4_1 or AP_F_V2_0_0 uses a hard-…9.8
• CVE-2022-29526Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Pri…5.3
• CVE-2022-29528An issue was discovered in MISP before 2.4.158. PHAR deseria…9.8
• CVE-2022-29529An issue was discovered in MISP before 2.4.158. There is sto…5.4
• CVE-2022-2953LibTIFF 4.4.0 has an out-of-bounds read in extractImageSecti…5.5
• CVE-2022-29530An issue was discovered in MISP before 2.4.158. There is sto…5.4
• CVE-2022-29531An issue was discovered in MISP before 2.4.158. There is sto…5.4
• CVE-2022-29532An issue was discovered in MISP before 2.4.158. There is XSS…4.8