Description

cloud-init through 25.1.2 includes the systemd socket unit cloud-init-hotplugd.socket with default SocketMode that grants 0666 permissions, making it world-writable. This is used for the "/run/cloud-init/hook-hotplug-cmd" FIFO. An unprivileged user could trigger hotplug-hook commands.

INFO

Published Date :

2025-06-26T09:25:20.199Z

Last Modified :

2025-06-26T19:14:46.084Z

Source :

canonical
AFFECTED PRODUCTS

The following products are affected by CVE-2024-11584 vulnerability.

Vendors Products
Canonical
  • Cloud-init
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2024-11584.

URL Resource
https://github.com/canonical/cloud-init/pull/6265/commits/6e10240a7f0a2d6110b398640b3fd46cfa9a7cf3 cve-icon cve-icon cve-icon
https://github.com/canonical/cloud-init/releases/tag/25.1.3 cve-icon cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2024-11584 cve-icon
https://www.cve.org/CVERecord?id=CVE-2024-11584 cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact