Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2024-11584

cloud-init through 25.1.2 includes the systemd socket unit cloud-init-hotplugd.socket with default SocketMode that grants 0666 permissions, making it world-writable. This is used for the "/run/cloud-init/hook-hotplug-cmd" FIFO. An unprivileged user could trigger hotplug-hook commands.

Published

2025-06-26T10:15:24.703

Last Modified

2025-09-05T15:20:25.690

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 5.9 (MEDIUM)

Weaknesses
  • Type: Secondary
    CWE-732
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application canonical cloud-init < 25.1.3 Yes
References