Improper Privilege Management in Node.js - CVE-2024-22017

Vulnerability identifier: #VU86723

CSH Severity: Low

CVSS v4: 9.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H]

CVE-ID: CVE-2024-22017

CWE-ID: CWE-269

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid(). A local user can escalate privileges on the system.

Node.js
Gentoo Linux
Amazon Linux AMI
Oracle Linux
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Anolis OS
Web and Scripting Module
openSUSE Leap
IBM Business Automation Workflow
IBM Cloud Transformation Advisor
Use Case Manager App
IBM Watson Discovery for IBM Cloud Pak for Data
EasyApache
IBM Cloud Pak for Business Automation
Answer Retrieval for Watson Discovery On Prem
IBM Planning Analytics Workspace
IBM Cloud Pak for Watson AIOps
Voice Gateway
nodejs-nodemon
npm
nodejs20
nodejs20-debugsource
nodejs20-docs
nodejs20-debuginfo
nodejs20-devel
npm20
corepack20
nodejs
nodejs-devel
nodejs-full-i18n
nodejs-docs
net-libs/nodejs
nodejs-packaging
nodejs-packaging-bundler
IBM Cognos Analytics

Install updates from vendor's website.

Node.js - addressed in versions 20.11.1, 21.6.2
Answer Retrieval for Watson Discovery On Prem - update to 2.16.0
Voice Gateway - addressed in versions 1.0.8.10, 1.0.8.18
IBM Planning Analytics Workspace - addressed in versions 2.0.95, 2.1.2
nodejs-nodemon - update to 3.0.1-1
IBM Cloud Transformation Advisor - update to 3.9.0
Use Case Manager App - update to 4.0.0
IBM Cloud Pak for Watson AIOps - update to 4.7.0
IBM Watson Discovery for IBM Cloud Pak for Data - update to 4.8.5
EasyApache - update to 4 2024-2-21
npm - update to 10.8.1-1.20.16.0.1
IBM Cognos Analytics - addressed in versions 11.2.4 FP4, 12.0.4
nodejs20 - update to 20.11.1-1
nodejs20-debugsource - update to 20.11.1-150500.11.6.1
nodejs20-docs - update to 20.11.1-150500.11.6.1
nodejs20 - update to 20.11.1-150500.11.6.1
nodejs20-debuginfo - update to 20.11.1-150500.11.6.1
nodejs20-devel - update to 20.11.1-150500.11.6.1
npm20 - update to 20.11.1-150500.11.6.1
corepack20 - update to 20.11.1-150500.11.6.1
nodejs - update to 20.16.0-1
nodejs-devel - update to 20.16.0-1
nodejs-full-i18n - update to 20.16.0-1
nodejs-docs - update to 20.16.0-1
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3.33, 23.0.2.5
net-libs/nodejs - update to 22.4.1
nodejs-packaging - update to 2021.06-4
nodejs-packaging-bundler - update to 2021.06-4

• https://nodejs.org/en/blog/vulnerability/february-2024-security-releases

• Multiple vulnerabilities in Node.js
• Multiple vulnerabilities in cPanel EasyApache
• SUSE update for nodejs20
• Multiple vulnerabilities in IBM Business Automation Workflow
• Multiple vulnerabilities in IBM Cloud Transformation Advisor
• Multiple vulnerabilities in IBM Answer Retrieval for Watson Discovery
• Multiple vulnerabilities in IBM Voice Gateway
• Multiple vulnerabilities in Oracle Linux
• Red Hat Enterprise Linux 8 update for nodejs:20
• Red Hat Enterprise Linux 9 update for the nodejs:20 module
• Multiple vulnerabilities in IBM Planning Analytics Local - IBM Planning Analytics Workspace
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• Multiple vulnerabilities in IBM Watson Discovery
• Amazon Linux AMI update for nodejs20
• Multiple vulnerabilities in IBM Cognos Analytics
• Multiple vulnerabilities in IBM Use Case Manager App
• Multiple vulnerabilities in IBM Cloud Pak for AIOps
• Anolis OS update for nodejs:20 module
• Gentoo update for Node.js