Microsoft Azure Monitor Agent Privilege Escalation Vulnerability

A vulnerability allowing deserialization of untrusted data in Azure Monitor Agent has been identified. This issue enables an authorized attacker to locally elevate privileges. The vulnerability arises because the agent improperly handles untrusted data, which could be exploited by a local user with write access to the configuration directory, allowing them to create malicious files that the agent might process.

Impact

Exploitation of this vulnerability could allow a local user to gain elevated privileges, potentially leading to root access on the virtual machine.

Remediation

Users can download the security update for Azure Monitor Agent from the Microsoft Learn website. The vulnerability affects Azure Monitor Agent versions prior to 1.36.3.