Skip to content
OpenAdvisories
High · 8.8 CVE-2024-6174 EUVD-2024-54707GHSA-w8g9-wp36-fchj

When a non-x86 platform is detected, cloud-init grants root access to a hardcoded url with a local IP address. To prevent this, cloud-init …

Published Jun 26, 2025 · Updated Jun 26, 2025 · Assigned by canonical

Vendor: Canonical Product: cloud-init Package: cloud-init Package: cloud-init Package: cloud-init Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

When a non-x86 platform is detected, cloud-init grants root access to a hardcoded url with a local IP address. To prevent this, cloud-init default configurations disable platform enumeration.

Affected products

VendorProductAffectedFixed
Canonical cloud-init 0.7.9 – < 25.1.3 25.1.3

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 cloud-init 25.1.4-1 —
Debian 13 cloud-init 25.1.4-1 —
Debian 12 cloud-init 22.4.2-1+deb12u3 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 24.04 LTS cloud-init 25.1.4-0ubuntu0~24.04.1 USN-7677-1
Ubuntu 22.04 LTS cloud-init 25.1.4-0ubuntu0~22.04.1 USN-7677-1
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 20.04 LTS cloud-init 24.4.1-0ubuntu0~20.04.3+esm1 USN-7677-1
Ubuntu Pro 18.04 LTS cloud-init 23.1.2-0ubuntu0~18.04.1+esm1 USN-7677-1
Ubuntu Pro 16.04 LTS cloud-init 21.1-19-gbad84ad4-0ubuntu1~16.04.4+esm2 USN-7677-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 10 cloud-init 24.4-3.el10_0.2 RHSA-2025:10844
RHEL 9 cloud-init 24.4-4.el9_6.3 RHSA-2025:10848
RHEL 8 cloud-init 23.4-7.el8_10.10 RHSA-2025:11324
Show 8 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 9.4 EUS cloud-init 23.4-7.el9_4.13 RHSA-2025:10876
RHEL 9.2 E4S cloud-init 22.1-10.el9_2.1 RHSA-2025:10879
RHEL 9.0 E4S cloud-init 21.1-19.el9_0.7 RHSA-2025:11295
RHEL 8.8 TUS cloud-init 22.1-8.el8_8.2 RHSA-2025:11339
RHEL 8.8 E4S cloud-init 22.1-8.el8_8.2 RHSA-2025:11339
RHEL 8.6 TUS cloud-init 21.1-15.el8_6.4 RHSA-2025:11337
RHEL 8.6 E4S cloud-init 21.1-15.el8_6.4 RHSA-2025:11337
RHEL 8.6 AUS cloud-init 21.1-15.el8_6.4 RHSA-2025:11337

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 cloud-init 24.4-3.el10_0.2 ALSA-2025:10844
AlmaLinux 9 cloud-init 24.4-4.el9_6.3.alma.1 ALSA-2025:10848
AlmaLinux 8 cloud-init 23.4-7.el8_10.10.alma.1 ALSA-2025:11324

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 8 cloud-init 23.4-7.el8_10.10.0.2 RLSA-2025:11324

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 cloud-init 25.1.3-160000.2.1 SUSE-RU-2026:20192-1
SLES 16.0 cloud-init 25.1.3-160000.2.1 SUSE-RU-2026:20192-1
SLE Micro 6.2 cloud-init 25.1.3-160000.2.1 SUSE-RU-2026:20174-1
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLE Micro 6.1 cloud-init 25.1.3-slfo.1.1_1.1 SUSE-SU-2025:20755-1
SLE Micro 6.0 cloud-init 25.1.3-1.1 SUSE-SU-2025:20656-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed cloud-init 25.1.3-1.1 openSUSE-SU-2025:15376-1
openSUSE Leap 16.0 cloud-init 25.1.3-160000.2.1 openSUSE-RU-2026:20129-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 cloud-init +2 22.2.2-1.amzn2023.1.14 ALAS2023-2025-1082
Amazon Linux 2 cloud-init 19.3-46.amzn2.0.6 ALAS2-2025-2926

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 cloud-init 24.3.1-2 —
Azure Linux 2 (CBL-Mariner) cloud-init 23.3-7 —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 10 cloud-init 24.4-3.0.1.el10_0.2 ELSA-2025-10844
Oracle Linux 9 cloud-init 24.4-4.0.1.el9_6.3 ELSA-2025-10848
Oracle Linux 8 cloud-init 23.4-7.0.2.el8_10.10 ELSA-2025-11324

Advisories 25

References