CVE-2024-11584

cloud-initthrough 25.1.2 includes the systemd socket unitcloud-init-hotplugd.socket with defaultSocketModethat grants 0666 permissions, making it world-writable.This is used for the "/run/cloud-init/hook-hotplug-cmd" FIFO. An unprivileged user could triggerhotplug-hook commands.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
5.9 MEDIUM
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
canonicalCNA
5.9 MEDIUM
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CISA-ADPADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 7%
VendorProductVersion
canonicalcloud-init
𝑥
< 25.1.3
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
cloud-init
bullseye
postponed
bookworm
22.4.2-1+deb12u3
fixed
trixie
25.1.4-1
fixed
forky
25.3-2
fixed
sid
25.3-2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
cloud-init
plucky
Fixed 25.1.4-0ubuntu0~25.04.1
released
oracular
ignored
noble
Fixed 25.1.4-0ubuntu0~24.04.1
released
jammy
Fixed 25.1.4-0ubuntu0~22.04.1
released
focal
Fixed 24.4.1-0ubuntu0~20.04.3+esm1
released
bionic
Fixed 23.1.2-0ubuntu0~18.04.1+esm1
released
xenial
not-affected
trusty
dne
Common Weakness Enumeration
References
https://github.com/canonical/cloud-init/pull/6265/commits/6e10240a7f0a2d6110b398640b3fd46cfa9a7cf3
https://github.com/canonical/cloud-init/releases/tag/25.1.3