Untriaged
Permalink
CVE-2024-11584
5.9 MEDIUM
- CVSS version: 3.1
- Attack vector (AV): LOCAL
- Attack complexity (AC): LOW
- Privileges required (PR): NONE
- User interaction (UI): NONE
- Scope (S): UNCHANGED
- Confidentiality impact (C): LOW
- Integrity impact (I): LOW
- Availability impact (A): LOW
cloud-init through 25.1.2 includes the systemd socket unit cloud-init-hotplugd.socket with …
cloud-init through 25.1.2 includes the systemd socket unit cloud-init-hotplugd.socket with default SocketMode that grants 0666 permissions, making it world-writable. This is used for the "/run/cloud-init/hook-hotplug-cmd" FIFO. An unprivileged user could trigger hotplug-hook commands.
References
Affected products
cloud-init
- <25.1.3
Matching in nixpkgs
pkgs.cloud-init
Provides configuration and customization of cloud instance
-
nixos-unstable -
- nixpkgs-unstable 25.2
Package maintainers
-
@jfroche Jean-François Roche <jfroche@pyxel.be>
-
@illustris Harikrishnan R <me@illustris.tech>