Insufficient verification of data authenticity in cloud-init - CVE-2024-6174

Vulnerability identifier: #VU112884

CSH Severity: High

CVSS v4: 7.7 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-6174

CWE-ID: CWE-345

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists in the way the application identified the boot data source. An attacker can create a rogue service on the local network to impersonate an openstack endpoint and provide root-configuration data to cloud-init on instance launch leading to a security backdoor to root during system boot.

cloud-init
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server 15 SP6
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Desktop 15
SUSE Manager Server
SUSE Manager Proxy
SUSE Manager Retail Branch Server
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux Server - AUS
Public Cloud Module
Python 3 Module
openSUSE Leap
Ubuntu
openEuler
Anolis OS
Fedora
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
python311-passlib
python311-jsonpatch
python311-jsonpointer
python311-pyserial
python311-configobj
cloud-init
cloud-init-help
cloud-init (Red Hat package)
cloud-init (Ubuntu package)
cloud-init-doc
cloud-init-config-suse

Install updates from vendor's website.

cloud-init - update to 25.1.3
python311-passlib - update to 1.7.4-150400.6.5.2
python311-jsonpatch - update to 1.32-150400.10.5.1
python311-jsonpointer - update to 2.3-150400.11.5.1
python311-pyserial - update to 3.5-150400.12.5.1
python311-configobj - update to 5.0.8-150400.12.5.1
cloud-init - addressed in versions 19.4-16, 21.4-36, 23.4.1-15
cloud-init-help - addressed in versions 19.4-16, 21.4-36, 23.4.1-15
cloud-init (Red Hat package) - addressed in versions 21.1-15.el8_6.4, 21.1-19.el9_0.7, 22.1-8.el8_8.2, 22.1-10.el9_2.1, 23.4-7.el8_10.10, 24.4-3.el10_0.2, 24.4-4.el9_6.3
cloud-init (Ubuntu package) - addressed in versions 21.1-19-gbad84ad4-0ubuntu1~16.04.4+esm2, 23.1.2-0ubuntu0~18.04.1+esm1, 24.4.1-0ubuntu0~20.04.3+esm1, 25.1.4-0ubuntu0~22.04.1, 25.1.4-0ubuntu0~24.04.1, 25.1.4-0ubuntu0~25.04.1
cloud-init - update to 23.2.2-1
cloud-init - addressed in versions 24.2-4.fc41, 24.2-5.fc42
cloud-init-doc - update to 25.1.3-150400.15.7.6
cloud-init-config-suse - update to 25.1.3-150400.15.7.6
cloud-init - update to 25.1.3-150400.15.7.6

• https://github.com/canonical/cloud-init/releases/tag/25.1.3
• https://bugs.launchpad.net/ubuntu/+source/cloud-init/+bug/2069607
• https://github.com/advisories/GHSA-w8g9-wp36-fchj

• Multiple vulnerabilities in Canonical cloud-init
• openEuler 24.03 LTS SP2 update for cloud-init
• openEuler 24.03 LTS SP1 update for cloud-init
• openEuler 24.03 LTS update for cloud-init
• openEuler 22.03 LTS SP4 update for cloud-init
• openEuler 22.03 LTS SP3 update for cloud-init
• openEuler 20.03 LTS SP4 update for cloud-init
• Red Hat Enterprise Linux 10 update for cloud-init
• Red Hat Enterprise Linux 9 update for cloud-init
• Red Hat Enterprise Linux 9 update for cloud-init
• Red Hat Enterprise Linux 9 update for cloud-init
• Red Hat Enterprise Linux 8 update for cloud-init
• Red Hat Enterprise Linux 8 update for cloud-init
• Red Hat Enterprise Linux 8 update for cloud-init
• Fedora 42 update for cloud-init
• Fedora 41 update for cloud-init
• Ubuntu update for cloud-init
• Anolis OS update for cloud-init
• Anolis OS update for cloud-init
• Anolis OS update for cloud-init
• SUSE update for cloud-init