A critical local privilege escalation vulnerability in the AWS Client VPN for macOS allows non-administrative users to gain root privileges through improper log file handling.

This vulnerability involves improper link resolution (CWE-59) during log rotation, where a local, low-privileged user can create a symlink to a privileged location to inject arbitrary code into log files, resulting in root-level execution.

The ability for a local user to escalate privileges to root on a machine running VPN software presents a severe security risk. An attacker could bypass system-level security controls, exfiltrate sensitive data, or install persistent backdoors, leading to full system compromise. With a CVSS score of 7.8, this high-severity flaw necessitates immediate attention to prevent unauthorized administrative control over affected endpoints.

Immediate Action: Update the AWS Client VPN for macOS to version 5.2.1 or the latest available version provided by AWS.

Proactive Monitoring: Review system logs for unusual file creation patterns or symlink activity within the log directories utilized by the VPN client.

Compensating Controls: Restrict local user access to the directory structures where the VPN client rotates its logs until the patch can be applied.

Public Exploit Available: No

Given the potential for complete system compromise via root-level code execution, organizations should prioritize deploying the 5.2.1 update to all macOS endpoints running the AWS Client VPN. Administrators should ensure that all users are transitioned to the patched version as soon as possible to eliminate the risk of local privilege escalation.