Incorrect default permissions in cloud-init - CVE-2024-11584

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU112883

Incorrect default permissions in cloud-init - CVE-2024-11584

Published: July 14, 2025


Vulnerability identifier: #VU112883
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-11584
CWE-ID: CWE-276
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to software includes the systemd socket unit cloud-init-hotplugd.socket with default SocketMode that grants 0666 permissions, making it world-writable. A local user with access to the system can execute hotplug-hook commands.


Affected software

cloud-init
SUSE Linux Enterprise Server 15 SP6
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Desktop 15
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
Public Cloud Module
Python 3 Module
openSUSE Leap
Ubuntu
openEuler
Anolis OS
Fedora
python311-passlib
python311-jsonpatch
python311-jsonpointer
python311-pyserial
python311-configobj
cloud-init (Ubuntu package)
cloud-init
cloud-init-help
cloud-init-doc
cloud-init-config-suse

How to mitigate CVE-2024-11584

Install updates from vendor's website.

cloud-init - update to 25.1.3
python311-passlib - update to 1.7.4-150400.6.5.2
python311-jsonpatch - update to 1.32-150400.10.5.1
python311-jsonpointer - update to 2.3-150400.11.5.1
python311-pyserial - update to 3.5-150400.12.5.1
python311-configobj - update to 5.0.8-150400.12.5.1
cloud-init (Ubuntu package) - addressed in versions 21.1-19-gbad84ad4-0ubuntu1~16.04.4+esm2, 23.1.2-0ubuntu0~18.04.1+esm1, 24.4.1-0ubuntu0~20.04.3+esm1, 25.1.4-0ubuntu0~22.04.1, 25.1.4-0ubuntu0~24.04.1, 25.1.4-0ubuntu0~25.04.1
cloud-init - addressed in versions 21.4-36, 23.4.1-15
cloud-init-help - addressed in versions 21.4-36, 23.4.1-15
cloud-init - update to 23.2.2-1
cloud-init - addressed in versions 24.2-4.fc41, 24.2-5.fc42
cloud-init - update to 25.1.3-150400.15.7.6
cloud-init-doc - update to 25.1.3-150400.15.7.6
cloud-init-config-suse - update to 25.1.3-150400.15.7.6

External References

Related Security Bulletins