CVE-2024-46544

What it actually does

Incorrect default permissions on Unix systems allow local users to view and modify the shared memory segment containing mod_jk configuration data, enabling information disclosure and denial of service.

Why it matters to the business

Local attackers can access sensitive connector configuration and disrupt web server operations on affected Unix deployments, potentially leading to service outages or data exposure in environments using Tomcat Connectors.

How an attack unfolds

A local user on an affected Unix system identifies the shared memory segment used by mod_jk, leverages permissive defaults to read configuration details for reconnaissance or alters the segment contents to trigger denial of service.

How to fix it

Upgrade Apache Tomcat Connectors to version 1.2.50. For Harbor deployments, upgrade to 2.8.6, 2.9.4, or 2.10.2 depending on the installed branch. Restrict shared memory access to the web server process owner only.

How to confirm the fix worked

Verify mod_jk version is 1.2.50 or later; inspect shared memory permissions with ipcs or similar tools to confirm only the intended user can access the segment; test connector functionality post-upgrade.

Typical attack path

1. Locate running mod_jk instance on Unix host
2. Identify shared memory segment via process inspection
3. Read or write to segment due to weak permissions
4. Extract configuration data or induce service failure

How to detect it

Review system logs and process listings for unexpected local access to mod_jk shared memory segments; examine permission changes or anomalous reads/writes on Unix IPC resources; correlate with user activity around the connector process.

What your security team should do

• Prioritize upgrade to 1.2.50 on all Unix Tomcat Connector installations
• Audit and tighten shared memory permissions across Unix hosts
• Review downstream Harbor instances for the listed fixed versions
• Monitor EPSS trend remains low but schedule remediation within standard patching cycles