Critical Vulnerability in cloud-init: World-Writable Socket Permissions
Summary
UBUNTU-CVE-2024-11584: cloud-init through 25.1.2 includes the systemd socket unit cloud-init-hotplugd.socket with default SocketMode that grants 0666 permissions, making it world-writable. This is used for the "/run/cloud-init/hook-hotplug-cmd... Affects cloud-init versions < 23.1.2-0ubuntu0~18.04.1+esm1. Fixed in 23.1.2-0ubuntu0~18.04.1+esm1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
cloud-init is a widely used package in cloud computing environments that automates the initialization of cloud instances. It is responsible for configuring cloud instances at boot time, including setting up networking, SSH keys, and other essential configurations. The package is integral to ensuring that cloud instances are properly set up and operational. However, a recent vulnerability has been identified that compromises its security by allowing unprivileged users to execute commands through a world-writable socket.
Vulnerability Detail
The vulnerability, identified as CVE-2024-11584, affects cloud-init versions up to 25.1.2. It stems from the inclusion of the systemd socket unit cloud-init-hotplugd.socket, which has default SocketMode permissions set to 0666. This configuration makes the socket world-writable, allowing any unprivileged user to trigger hotplug-hook commands via the '/run/cloud-init/hook-hotplug-cmd' FIFO. The ramifications of this vulnerability include potential unauthorized command execution, which could lead to further exploitation of the system.
How To Fix
Minimum fixed version
23.1.2-0ubuntu0~18.04.1+esm1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade cloud-initTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the socket by modifying its permissions. This can be done by executing the following command:
sudo chmod 0660 /run/cloud-init/hook-hotplug-cmd
This command will change the permissions of the socket, preventing unprivileged users from writing to it until the package can be updated.
Conclusion
The vulnerability CVE-2024-11584 in the cloud-init package poses a significant risk due to its world-writable socket permissions. Users are strongly advised to update to the patched version to mitigate potential security threats. Additionally, implementing temporary workarounds can help secure systems until updates are applied.
See every vulnerability recorded for cloud-init →
FAQ
CVE-2024-11584 is a vulnerability in the cloud-init package that allows unprivileged users to execute commands due to world-writable socket permissions.
You can check your version of cloud-init by running 'cloud-init --version' in the terminal. If it is below 25.1.4, it is affected.
The vulnerability could allow unauthorized command execution, leading to further exploitation of the system and potential data breaches.
Yes, you can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities using a manifest file like package-lock.json.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring signup.
Related vulnerabilities
Recent vulnerabilities recorded for cloud-init.
