CVE-2024-6174

When a non-x86 platform is detected, cloud-init grants root access to a hardcoded url with a local IP address. To prevent this, cloud-init default configurations disable platform enumeration.

Cloud-init is the defacto multi-distribution package that handles early initialization of a cloud instance.

Security Fix(es):

cloud-init is an industry-standard multi-distribution method for cross-platform cloud instance initialization by Canonical. There is a security vulnerability in cloud-init, which originates from granting root access to hardcoded URLs during detection by non-x86 platforms.(CVE-2024-6174)

Cloud-init is the defacto multi-distribution package that handles early initialization of a cloud instance.

Security Fix(es):

cloud-init is an industry-standard multi-distribution method for cross-platform cloud instance initialization by Canonical. There is a security vulnerability in cloud-init 25.1.2 and previous versions. The vulnerability originates from cloud-init-hotplugd.socket's default SocketMode permission is 0666, which may cause unauthorized users to trigger commands.(CVE-2024-11584)

cloud-init is an industry-standard multi-distribution method for cross-platform cloud instance initialization by Canonical. There is a security vulnerability in cloud-init, which originates from granting root access to hardcoded URLs during detection by non-x86 platforms.(CVE-2024-6174)

Cloud-init is the defacto multi-distribution package that handles early initialization of a cloud instance.

Security Fix(es):

cloud-init is an industry-standard multi-distribution method for cross-platform cloud instance initialization by Canonical. There is a security vulnerability in cloud-init 25.1.2 and previous versions. The vulnerability originates from cloud-init-hotplugd.socket's default SocketMode permission is 0666, which may cause unauthorized users to trigger commands.(CVE-2024-11584)

cloud-init is an industry-standard multi-distribution method for cross-platform cloud instance initialization by Canonical. There is a security vulnerability in cloud-init, which originates from granting root access to hardcoded URLs during detection by non-x86 platforms.(CVE-2024-6174)

Cloud-init is the defacto multi-distribution package that handles early initialization of a cloud instance.

Security Fix(es):

cloud-init is an industry-standard multi-distribution method for cross-platform cloud instance initialization by Canonical. There is a security vulnerability in cloud-init 25.1.2 and previous versions. The vulnerability originates from cloud-init-hotplugd.socket's default SocketMode permission is 0666, which may cause unauthorized users to trigger commands.(CVE-2024-11584)

cloud-init is an industry-standard multi-distribution method for cross-platform cloud instance initialization by Canonical. There is a security vulnerability in cloud-init, which originates from granting root access to hardcoded URLs during detection by non-x86 platforms.(CVE-2024-6174)

Cloud-init is the defacto multi-distribution package that handles early initialization of a cloud instance.

Security Fix(es):

cloud-init is an industry-standard multi-distribution method for cross-platform cloud instance initialization by Canonical. There is a security vulnerability in cloud-init 25.1.2 and previous versions. The vulnerability originates from cloud-init-hotplugd.socket's default SocketMode permission is 0666, which may cause unauthorized users to trigger commands.(CVE-2024-11584)

cloud-init is an industry-standard multi-distribution method for cross-platform cloud instance initialization by Canonical. There is a security vulnerability in cloud-init, which originates from granting root access to hardcoded URLs during detection by non-x86 platforms.(CVE-2024-6174)

Cloud-init is the defacto multi-distribution package that handles early initialization of a cloud instance.

Security Fix(es):

cloud-init is an industry-standard multi-distribution method for cross-platform cloud instance initialization by Canonical. There is a security vulnerability in cloud-init 25.1.2 and previous versions. The vulnerability originates from cloud-init-hotplugd.socket's default SocketMode permission is 0666, which may cause unauthorized users to trigger commands.(CVE-2024-11584)

cloud-init is an industry-standard multi-distribution method for cross-platform cloud instance initialization by Canonical. There is a security vulnerability in cloud-init, which originates from granting root access to hardcoded URLs during detection by non-x86 platforms.(CVE-2024-6174)

The cloud-init packages provide a set of init scripts for cloud instances. Cloud instances need special scripts to run during initialization to retrieve and install SSH keys, and to let the user run various scripts.

Security Fix(es):

• cloud-init: Cloud init permissions flaw (CVE-2024-6174)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

When a non-x86 platform is detected, cloud-init grants root access to a hardcoded url with a local IP address. To prevent this, cloud-init default configurations disable platform enumeration.

The cloud-init packages provide a set of init scripts for cloud instances. Cloud instances need special scripts to run during initialization to retrieve and install SSH keys, and to let the user run various scripts.

Security Fix(es):

• cloud-init: Cloud init permissions flaw (CVE-2024-6174)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The cloud-init packages provide a set of init scripts for cloud instances. Cloud instances need special scripts to run during initialization to retrieve and install SSH keys, and to let the user run various scripts.

Security Fix(es):

• cloud-init: Cloud init permissions flaw (CVE-2024-6174)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The cloud-init packages provide a set of init scripts for cloud instances. Cloud instances need special scripts to run during initialization to retrieve and install SSH keys, and to let the user run various scripts.

Security Fix(es):

• cloud-init: Cloud init permissions flaw (CVE-2024-6174)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

When a non-x86 platform is detected, cloud-init grants root access to a hardcoded url with a local IP address. To prevent this, cloud-init default configurations disable platform enumeration.

When a non-x86 platform is detected, cloud-init grants root access to a hardcoded url with a local IP address. To prevent this, cloud-init default configurations disable platform enumeration.

• CVE-2024-6174: fix platform enumeration by changing default policy of ds-identify to disallow discovery of datasources without strict identifiable
• CVE-2024-11584: fix systemd socket unit permission vulnerability to prevent unprivileged user from triggering hotplug-hook commands
• CVE-2023-1786: fix leak of sensitive user/vendor data and enforce 640 perms on cloud-init.log
• CVE-2022-2084: remove schema errors from log to avoid leaking sensitive user-data values into world-readable /var/log/cloud-init.log
• rebuild with the vendor .el9_2 dist so the update outranks AlmaLinux 22.1-10.el9_2.alma

This update for cloud-init fixes the following issues:

Changes in cloud-init:

• Fix dependency replace -serial with -pyserial

• Drop unneeded test dependency on httpretty, fixed long ago

  • https://github.com/canonical/cloud-init/pull/1720

• Update to version 25.1.3 (bsc#1245401 , CVE-2024-6174, bsc#1245403, CVE-2024-11584)

These are all security issues fixed in the cloud-init-25.1.3-1.1 package on the GA media of openSUSE Tumbleweed.

This update for cloud-init fixes the following issues:

Changes in cloud-init:

• Fix dependency replace -serial with -pyserial

• Drop unneeded test dependency on httpretty, fixed long ago

  • https://github.com/canonical/cloud-init/pull/1720

• Update to version 25.1.3 (bsc#1245401 , CVE-2024-6174, bsc#1245403, CVE-2024-11584)

This update for cloud-init fixes the following issues:

Changes in cloud-init:

• Fix dependency replace -serial with -pyserial

• Drop unneeded test dependency on httpretty, fixed long ago

  • https://github.com/canonical/cloud-init/pull/1720

• Update to version 25.1.3 (bsc#1245401 , CVE-2024-6174, bsc#1245403, CVE-2024-11584)

This update for cloud-init fixes the following issues:

Update to version 25.1.3:

• CVE-2024-6174: Unpriveleged user could trigger hotplug-hook commands (bsc#1245403).

None security fixes:

• Rebase cloud-init to 24.4 or higher (bsc#1239715, jsc#PED-8680).
• Fixed cloud-init --debug status (bsc#1228414).
• Using ssh_pwauth: True in cloud-init breaks ssh for root (bsc#1237764).
• Fixed FileNotFoundError (bsc#1236720).
• Fixed python 3.13 support (bsc#1233649).

This update for cloud-init fixes the following issues:

Update to version 25.1.3 (bsc#1245401,bsc#1245403):

• docs: provide example3 for PAM and ssh_pwauth behavior (#27)
• fix: Make hotplug socket writable only by root (#25) (CVE-2024-11584)
• fix: Don't attempt to identify non-x86 OpenStack instances (LP: #2069607) (CVE-2024-6174)

From 25.1.2:

• fix: ensure MAAS datasource retries on failure (#6167)

Update to version 25.1.1 (bsc#1239715,jsc#PED-8680,bsc#1228414):

• Drop hidesensitivedata in 16 & greater
• test: pytestify cc_chef tests, add migration test
• chef: migrate files in old config directories for backups and cache
• fix: correct the path for Chef's backups (#5994)
• fix(Azure): don't reraise FileNotFoundError during ephemeral setup (#6113)
• fix(azure): handle unexpected exceptions during obtain_lease() (#6092) [Ksenija Stanojevic]
• Allow to set mac_address for VLAN subinterface (#6081) [jumpojoy] (GH: 5364)
• fix: Remove erroneous EC2 reference from 503 warning (#6077)
• fix: NM reload and bring up individual network conns (#6073) [Ani Sinha]
• fix: stop warning on dual-stack request failure (#6044)
• fix: install_method: pip cannot find ansible-pull command path (#6021) [Hasan Aliyev] (GH: 5720)
• fix: Fix DataSourceAliYun exception_cb signature (#6068) (GH: 6066)
• fix: Update OauthUrlHelper to use readurl exception_cb signature (GH: 6065)
• test: add OauthUrlHelper tests
• test: Remove CiTestCase from test_url_helper.py
• test: pytestify test_url_helper.py
• fix: track more removed modules (#6043)

From 25.1:

• ci: fix post-merge packaging CI (#6038)
• feat(azure): Fix imds-based ssh_pwauth (#6002) [Ksenija Stanojevic]
• ci: check for sorted patches (#6036)
• feat: aliyun datasource support crawl metadata at once (#5942) [jinkangkang]
• docs: document /usr merge breaking change (#6032)
• test: Add integration test for /var mounts (#6033)
• test: Ensure pre-24.2 custom modules work (#6034)
• doc: Update references to older keys (#6022) [Pedro Ribeiro]
• fix: untyped-defs in tests/unittests/{config, net, sources} (#6023) [Romain]
• fix: don't reference PR in post-merged CI (#6019)
• chore: explicitly skip broken ansible integration tests (#5996) [a-dubs]
• tests(oracle): fix test_install_missing_deps apt race condition (#5996) [a-dubs]
• test(oracle): fix test_ubuntu_drivers_installed (#5996) [a-dubs]
• test(oracle): fix test_frequency_override integration test (#5996) [a-dubs]
• chore: add type hint to IntegrationCloud's cloud_instance field (#5996) [a-dubs]
• test(oracle): fix modules/test_lxd.py::test_storage_lvm on noble (#5996) [a-dubs]
• commit 9e591fff266be9d4c83f74ec02a717b74993304d [a-dubs]
• net/sysconfig: do not remove all existing settings of /etc/sysconfig/network (#5991) [Ani Sinha] (GH: 5990)
• fix: remove wrong return when checking if network necessary (#6013)
• fix: typing for rsyslog, ubuntu_pro, power_state_change (#5985) [MostafaTarek124eru]
• fix: Retry on OpenStack HTTP status codes (#5943) [weiyang] (GH: 5687)
• fix: Ensure fqdn is treated as string in get_hostname_fqdn (#5993) [MKhatibzadeh] (GH: 5989)
• feat(vmware): Convert imc network config to v2 (#5937) [PengpengSun]
• ci: add upstream post-merge test
• ci: check if upstream commit causes ubuntu patch conflicts
• ci: organize cla tests together
• test: eliminate obsolete cases, add non-error case
• chore: remove redundant manual schema validation
• doc: clarify subiquity docs
• chore: cleanup `len' usage (#5956) [Shreenidhi Shedi]
• Fix: GCE _get_data crashes if DHCP lease fails (#5998) [Bryan Fraschetti]
• Fixes GH-5997
• fix: correct the path for Chef's cache (#5994) [MostafaTarek124eru] (GH: 5090)
• fix: Run ansible with run_user instead of root for distro install_method (#5986) [Amirhossein Shaerpour] (GH: 4092)
• fix: retry AWS hotplug for async IMDS (#5995) (GH: 5373)
• feat(integration_tests): add optional…

This update for cloud-init fixes the following issues:

• Update to version 25.1.3 (bsc#1245403, CVE-2024-11584, CVE-2024-6174)
• Update to version 25.1.1 (bsc#1239715, jsc#PED-8680, bsc#1228414, bsc#1237764)
• Make sure a directory exists, if not create it, before writing in that location (bsc#1236720)
• rsyslog warning, '~' is deprecated (bsc#1170154)
• Support python 3.13 (bsc#1233649)
• Move fdupes call back to %install (bsc#1214169)
• Re-ship python dependencies, those have no source changes.

Harry Sintonen discovered that the hotplugd socket in cloud-init was world writable. An attacker could possibly use this issue to send hotplug-hook commands. (CVE-2024-11584)

It was discovered that cloud-init granted root access to a hardcoded URL with a local IP address when a non-x86 platform is detected. An attacker could possibly impersonate an OpenStack endpoint and provide root configuration data. (CVE-2024-6174)