Critical Vulnerabilities in Cloud-Init: Security Risks and Mitigation
Summary
USN-7677-1: cloud-init vulnerabilities. Affects cloud-init versions < 21.1-19-gbad84ad4-0ubuntu1~16.04.4+esm2. Fixed in 21.1-19-gbad84ad4-0ubuntu1~16.04.4+esm2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Cloud-init is a widely used package in cloud computing environments that automates the initialization of cloud instances. It is responsible for configuring and customizing cloud instances at boot time, allowing for seamless integration and management of cloud resources. However, recent vulnerabilities have been identified that could potentially compromise the security of systems utilizing cloud-init.
Vulnerability Detail
Two significant vulnerabilities have been discovered in cloud-init. The first, identified as CVE-2024-11584, involves a world-writable hotplugd socket, which could allow an attacker to send unauthorized hotplug-hook commands. The second vulnerability, CVE-2024-6174, relates to cloud-init granting root access to a hardcoded URL with a local IP address when a non-x86 platform is detected, enabling an attacker to impersonate an OpenStack endpoint and provide malicious root configuration data. These vulnerabilities pose serious risks, including unauthorized access and potential system compromise.
How To Fix
Minimum fixed version
21.1-19-gbad84ad4-0ubuntu1~16.04.4+esm2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade cloud-initTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the hotplugd socket by changing its permissions. This can be done using the following command:
sudo chmod 700 /run/cloud-init/hotplugd.sock
However, this is not a permanent solution and should be followed by an update to the patched version of cloud-init.
Conclusion
In summary, critical vulnerabilities have been identified in the cloud-init package that could expose systems to significant security risks. It is essential to update to the patched versions of cloud-init as soon as possible to mitigate these vulnerabilities and ensure the security of your cloud environments.
See every vulnerability recorded for cloud-init →
FAQ
The main vulnerabilities are CVE-2024-11584, which involves a world-writable hotplugd socket, and CVE-2024-6174, which allows root access through a hardcoded URL with a local IP address.
You can use the Vulert playground at Vulert Scanner to check if your application is affected without needing to sign up.
These vulnerabilities can lead to unauthorized access and potential system compromise, allowing attackers to execute commands or provide malicious configuration data.
You can update cloud-init using the package manager on your Ubuntu system with the commands provided in the 'how_to_fix' section.
Yes, you can temporarily restrict access to the hotplugd socket by changing its permissions, but this is not a permanent fix.
References
Related vulnerabilities
Recent vulnerabilities recorded for cloud-init.
