CVE-2024-21892: Code injection and privilege escalation through Linux capabilities

Published Feb 14, 2024
·
Updated

Code injection and privilege escalation through Linux capabilities

Other sources

Node.js could allow a local authenticated attacker to gain elevated privileges on the system, caused by a bug in the implementation of the exception of CAPNETBINDSERVICE. An attacker could exploit this vulnerability to inject code that inherits the process's elevated privileges.

— IBM

On Linux, Node.js ignores certain environment variables if those may have been set by an unprivileged user while the process is running with elevated privileges with the only exception of CAPNETBINDSERVICE.

Due to a bug in the implementation of this exception, Node.js incorrectly applies this exception even when certain other capabilities have been set.

This allows unprivileged users to inject code that inherits the process's elevated privileges.

— Node.Js

Affected Software

31 affected componentsFixes available
redhat/node<18.19.1
18.19.1
redhat/node<20.11.1
20.11.1
redhat/node<21.6.2
21.6.2
IBM Cognos Analytics<=12.0.0-12.0.3
IBM Cognos Analytics<=11.2.0-11.2.4 FP3
All of the following
Any of the following
Nodejs Node.js>=18.0.0<18.19.1
Nodejs Node.js>=20.0.0<20.11.1
Nodejs Node.js>=21.0.0<21.6.2
Linux Linux kernel
Node.js Node.js>=18.0.0<18.19.1, >=20.0.0<20.11.1, >=21.0.0<21.6.2
18.19.120.11.121.6.2
Node.js Node.js>=18.0.0<18.19.1
18.19.1
Node.js Node.js>=20.0.0<20.11.1
20.11.1
Node.js Node.js>=21.0.0<21.6.2
21.6.2
debian/nodejs<18.20.4+dfsg-1~deb12u1
18.20.4+dfsg-1~deb12u1
debian/nodejs<18.19.1+dfsg-1
18.19.1+dfsg-1
debian/nodejs<18.19.1+dfsg-1
18.19.1+dfsg-1
debian/nodejs
18.20.4+dfsg-1~deb12u218.20.4+dfsg-1~deb12u320.19.2+dfsg-1+deb13u220.19.2+dfsg-1+deb13u324.21.0+dfsg+~cs24.13.4-124.22.2+dfsg+~cs24.19.2-1
alpine/openjdk17<17.0.11_p9-r0
17.0.11_p9-r0
alpine/openjdk17<17.0.11_p9-r0
17.0.11_p9-r0
alpine/openjdk17<17.0.11_p9-r0
17.0.11_p9-r0
alpine/openjdk17<17.0.11_p9-r0
17.0.11_p9-r0
alpine/openjdk17<17.0.11_p9-r0
17.0.11_p9-r0
alpine/openjdk17<17.0.11_p9-r0
17.0.11_p9-r0
alpine/openjdk17<17.0.11_p9-r0
17.0.11_p9-r0
alpine/openjdk17<17.0.11_p9-r0
17.0.11_p9-r0
alpine/openjdk21<21.0.3_p9-r0
21.0.3_p9-r0
alpine/openjdk21<21.0.3_p9-r0
21.0.3_p9-r0
alpine/openjdk21<21.0.3_p9-r0
21.0.3_p9-r0
alpine/openjdk21<21.0.3_p9-r0
21.0.3_p9-r0
alpine/openjdk21<21.0.3_p9-r0
21.0.3_p9-r0
alpine/openjdk21<21.0.3_p9-r0
21.0.3_p9-r0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade redhat/node to a version that resolves this vulnerability.

    Fixed in 18.19.1
  2. Upgrade

    Upgrade redhat/node to a version that resolves this vulnerability.

    Fixed in 20.11.1
  3. Upgrade

    Upgrade redhat/node to a version that resolves this vulnerability.

    Fixed in 21.6.2
  4. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 18.19.1Fixed in 20.11.1Fixed in 21.6.2
  5. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 18.19.1
  6. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 20.11.1
  7. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 21.6.2
  8. Upgrade

    Upgrade debian/nodejs to a version that resolves this vulnerability.

    Fixed in 18.20.4+dfsg-1~deb12u1
  9. Upgrade

    Upgrade debian/nodejs to a version that resolves this vulnerability.

    Fixed in 18.19.1+dfsg-1
  10. Upgrade

    Upgrade debian/nodejs to a version that resolves this vulnerability.

    Fixed in 18.20.4+dfsg-1~deb12u2Fixed in 18.20.4+dfsg-1~deb12u3Fixed in 20.19.2+dfsg-1+deb13u2Fixed in 20.19.2+dfsg-1+deb13u3Fixed in 24.21.0+dfsg+~cs24.13.4-1Fixed in 24.22.2+dfsg+~cs24.19.2-1
  11. Upgrade

    Upgrade alpine/openjdk17 to a version that resolves this vulnerability.

    Fixed in 17.0.11_p9-r0
  12. Upgrade

    Upgrade alpine/openjdk21 to a version that resolves this vulnerability.

    Fixed in 21.0.3_p9-r0
  13. Upgrade

    Upgrade Node.js to a version that resolves this vulnerability.

    Fixed in 18.19.1

Event History

Feb 14, 2024
CVE Published
via Node.js·03:30 PM
Data Sourced
via Node.js·03:30 PM
DescriptionSeverity
Data Sourced
via Node.js·05:35 PM
Affected Software
Feb 20, 2024
CVE Published
via MITRE·01:31 AM
Data Sourced
via MITRE·01:31 AM
DescriptionSeverity
Data Sourced
via NVD·02:15 AM
DescriptionSeverityWeaknessAffected Software
Data Sourced
via OSV·02:15 AM
DescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

1

What is the severity of CVE-2024-21892?

CVE-2024-21892 is classified as a high severity vulnerability due to its potential to allow local authenticated attackers to gain elevated privileges.

2

How do I fix CVE-2024-21892?

To mitigate CVE-2024-21892, update Node.js to versions 18.19.1, 20.11.1, or 21.6.2, or apply the appropriate patches for affected IBM Cognos Analytics releases.

3

Who is affected by CVE-2024-21892?

CVE-2024-21892 affects users running specific versions of Node.js and IBM Cognos Analytics on Linux systems.

4

What does CVE-2024-21892 exploit?

CVE-2024-21892 exploits a bug in the implementation of the exception of CAP_NET_BIND_SERVICE in Node.js on Linux.

5

What are the potential impacts of CVE-2024-21892?

If exploited, CVE-2024-21892 could allow attackers to inject code that inherits elevated privileges from the Node.js process.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203