CVE-2024-11584

EUVD-2024-54980
cloud-init through 25.1.2 includes the systemd socket unit cloud-init-hotplugd.socket with default SocketMode that grants 0666 permissions, making it world-writable. This is used for the "/run/cloud-init/hook-hotplug-cmd" FIFO. An unprivileged user could trigger hotplug-hook commands.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.9 MEDIUM
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
canonicalCNA
5.9 MEDIUM
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: 7%
Affected Products (NVD)
VendorProductVersion
canonicalcloud-init
𝑥
< 25.1.3
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
cloud-init
bookworm
22.4.2-1+deb12u3
fixed
bullseye
postponed
forky
25.3-2
fixed
sid
25.3-2
fixed
trixie
25.1.4-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
cloud-init
bionic
Fixed 23.1.2-0ubuntu0~18.04.1+esm1
released
focal
Fixed 24.4.1-0ubuntu0~20.04.3+esm1
released
jammy
Fixed 25.1.4-0ubuntu0~22.04.1
released
noble
Fixed 25.1.4-0ubuntu0~24.04.1
released
oracular
ignored
plucky
Fixed 25.1.4-0ubuntu0~25.04.1
released
trusty
dne
xenial
not-affected
Common Weakness Enumeration
References
https://github.com/canonical/cloud-init/pull/6265/commits/6e10240a7f0a2d6110b398640b3fd46cfa9a7cf3
https://github.com/canonical/cloud-init/releases/tag/25.1.3