SB2025081547 - Anolis OS update for cloud-init
Published: August 15, 2025
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 secuirty vulnerabilities.
1) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2022-2084)
The vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to logged schema failures can include password hashes. A local user can read the log files and gain access to sensitive data.
2) Information disclosure (CVE-ID: CVE-2023-1786)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output by the application. A remote attacker can gain unauthorized access to sensitive information on the system.
3) Incorrect default permissions (CVE-ID: CVE-2024-11584)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to software includes the systemd socket unit cloud-init-hotplugd.socket with default SocketMode that grants 0666 permissions, making it world-writable. A local user with access to the system can execute hotplug-hook commands.
4) Insufficient verification of data authenticity (CVE-ID: CVE-2024-6174)
The vulnerability allows a remote attacker to perform MitM attack.
The vulnerability exists in the way the application identified the boot data source. An attacker can create a rogue service on the local network to impersonate an openstack endpoint and provide root-configuration data to cloud-init on instance launch leading to a security backdoor to root during system boot.
Remediation
Install update from vendor's website.