CVE-2024-6174: High severity Canonical cloud-init vulnerability
When a non-x86 platform is detected, cloud-init grants root access to a hardcoded url with a local IP address. To prevent this, cloud-init default configurations disable platform enumeration.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable platform enumeration in cloud-init configuration.
cloud-init platform enumeration = disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2024-6174?
CVE-2024-6174 has a high severity rating due to the risk of unauthorized root access.
How do I fix CVE-2024-6174?
To fix CVE-2024-6174, upgrade to the latest version of cloud-init where the vulnerability has been patched.
What platforms are affected by CVE-2024-6174?
CVE-2024-6174 affects non-x86 platforms running cloud-init.
What are the potential risks of CVE-2024-6174?
The risks include unauthorized access to the system, which could lead to data breaches or system compromise.
What mitigation measures can be taken for CVE-2024-6174 before a patch is applied?
As a mitigation measure, ensure that platform enumeration is disabled in your cloud-init configuration.