Summary
Harry Sintonen discovered that the hotplugd socket in cloud-init was world
writable. An attacker could possibly use this issue to send hotplug-hook
commands. (CVE-2024-11584)
It was discovered that cloud-init granted root access to a hardcoded URL
with a local IP address when a non-x86 platform is detected. An attacker
could possibly impersonate an OpenStack endpoint and provide root
configuration data. (CVE-2024-6174)
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | cloud-init | 25.1.4-0ubuntu0~22.04.1 |
| Ubuntu · 24.04 LTS 24.04:LTS | cloud-init | 25.1.4-0ubuntu0~24.04.1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | cloud-init | 21.1-19-gbad84ad4-0ubuntu1~16.04.4+esm2 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | cloud-init | 23.1.2-0ubuntu0~18.04.1+esm1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | cloud-init | 24.4.1-0ubuntu0~20.04.3+esm1 |
Vulnerabilities 2
-
High 8.8
When a non-x86 platform is detected, cloud-init grants root access to a hardcoded url with a local IP address. To preve…
-
Medium 5.9
cloud-init through 25.1.2 includes the systemd socket unit cloud-init-hotplugd.socket with default SocketMode that gran…