CVE-2024-11584: Medium severity cloud-init cloud-init vulnerability
cloud-init through 25.1.2 includes the systemd socket unit cloud-init-hotplugd.socket with default SocketMode that grants 0666 permissions, making it world-writable. This is used for the "/run/cloud-init/hook-hotplug-cmd" FIFO. An unprivileged user could trigger hotplug-hook commands.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-11584?
CVE-2024-11584 has a medium severity due to the vulnerability allowing unprivileged users to execute commands through a world-writable FIFO.
How do I fix CVE-2024-11584?
To fix CVE-2024-11584, update to cloud-init version 25.1.3 or later, which addresses the vulnerable socket permissions.
Which versions of cloud-init are affected by CVE-2024-11584?
CVE-2024-11584 affects all cloud-init versions up to and including 25.1.2.
What impact does CVE-2024-11584 have on system security?
The impact of CVE-2024-11584 allows unprivileged users to execute hotplug commands which can potentially compromise system integrity.
Are there any workarounds for CVE-2024-11584 before upgrading?
A possible workaround for CVE-2024-11584 is to manually change the permissions of the cloud-init socket to restrict access until an upgrade can be performed.