Privilege Escalation Vulnerability in Node.js Package - CVE-2024-22017
Summary
UBUNTU-CVE-2024-22017: setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid(). Affects nodejs versions < 20.18.1+dfsg-1ubuntu2. Fixed in 20.18.1+dfsg-1ubuntu2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a popular open-source runtime environment that allows developers to execute JavaScript code server-side. It is widely used for building scalable network applications. The affected version, 20.18.1+dfsg-1ubuntu2, includes several binaries such as libnode-dev, libnode115, and nodejs itself. This vulnerability poses a significant risk to users who rely on Node.js for their applications.
Vulnerability Detail
The vulnerability arises from the improper handling of setuid() calls in libuv's internal io_uring operations. If these operations are initialized before a call to setuid(), it allows the process to retain privileged operations even after dropping such privileges. This issue affects all users running Node.js versions 18.18.0 and above, including 20.4.0 and 21, potentially leading to unauthorized access and control over the system.
How To Fix
Minimum fixed version
20.18.1+dfsg-1ubuntu2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the affected versions of Node.js until they can apply the patch. Additionally, ensure that any operations requiring elevated privileges are handled securely and appropriately.
Conclusion
CVE-2024-22017 is a critical vulnerability in Node.js that can lead to privilege escalation. Users are strongly advised to update to the patched version to mitigate risks. Regular monitoring and security practices are essential to safeguard applications against such vulnerabilities.
See every vulnerability recorded for nodejs →
FAQ
CVE-2024-22017 is a privilege escalation vulnerability in Node.js that allows processes to perform privileged operations despite dropping privileges.
All versions greater than or equal to Node.js 18.18.0, including 20.4.0 and 21, are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The CVSS score for CVE-2024-22017 is 7.3, indicating a high severity level.
If you cannot update immediately, consider implementing security measures to limit access to your application and monitor for any suspicious activity.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
