{"id":"CVE-2024-22017","aliases":["ALSA-2024:1687","ALSA-2024:1688","AZL-35886","AZL-35899","BELL-CVE-2024-22017","BIT-node-2024-22017","BIT-node-min-2024-22017","EUVD-2024-19623","GHSA-vr4q-vx84-9g5x","RHSA-2024:1687","RHSA-2024:1688","RLSA-2024:1687","RLSA-2024:1688","SUSE-SU-2024:0643-1","UBUNTU-CVE-2024-22017","openSUSE-SU-2024:13697-1","openSUSE-SU-2024:13698-1","openSUSE-SU-2024:13972-1"],"status":"published","title":"setuid() does not affect libuv's internal io_uring operations if initialized before the call to...","description":"setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid().\nThis allows the process to perform privileged operations despite presumably having dropped such privileges through a call to setuid().\nThis vulnerability affects all users using version greater or equal than Node.js 18.18.0, Node.js 20.4.0 and Node.js 21.","severity":{"version":"3.0","score":7.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00893,"percentile":0.59711,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-250"],"published":"2024-02-16T08:55:10.785053Z","modified":"2026-10-29T11:31:06Z","exploits":[{"source":"pocgithub","id":"SpiralBL0CK/cve-2024-22017_to_test","title":"SpiralBL0CK/cve-2024-22017_to_test","date":"2025-01-12","url":"https://github.com/SpiralBL0CK/cve-2024-22017_to_test"}],"fixes":[{"ecosystem":"Azure Linux:3","package":"libuv","fixed_in":["1.48.0-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"nodejs","fixed_in":["20.14.0-1"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"nodejs","fixed_in":["20.11.1-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"nodejs","fixed_in":["20.11.1-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"node","fixed_in":["20.11.1","21.6.2"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"node-min","fixed_in":["20.11.1","21.6.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"nodejs-electron","fixed_in":["29.4.0-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.11.1-1.module_el8.9.0+3775+d8460d35"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.11.1-1.module_el8.9.0+3775+d8460d35"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.11.1-1.module_el8.9.0+3775+d8460d35"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.11.1-1.module_el8.9.0+3775+d8460d35"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-1.module_el8.9.0+3731+490e3ce5"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el8.9.0+3684+11b9e959"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el8.9.0+3684+11b9e959"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.2.4-1.20.11.1.1.module_el8.9.0+3775+d8460d35"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.11.1-1.module_el9.3.0+88+29afeaa2"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.11.1-1.module_el9.3.0+88+29afeaa2"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.11.1-1.module_el9.3.0+88+29afeaa2"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.11.1-1.module_el9.3.0+88+29afeaa2"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-1.module_el9.3.0+47+c33bc288"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el9.3.0+48+1cf146a1"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el9.3.0+48+1cf146a1"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:9","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.2.4-1.20.11.1.1.module_el9.3.0+88+29afeaa2"}]}],"bundled":7},{"source":"osv","ecosystem":"Azure Linux:3","package":"libuv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.48.0-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.14.0-1"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.16.1-r0"},{"fixed":"20.11.1-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.16.1-r0"},{"fixed":"20.11.1-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"node","ranges":[{"type":"SEMVER","events":[{"introduced":"20.0.0"},{"fixed":"20.11.1"},{"introduced":"21.0.0"},{"fixed":"21.6.2"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"node-min","ranges":[{"type":"SEMVER","events":[{"introduced":"20.0.0"},{"fixed":"20.11.1"},{"introduced":"21.0.0"},{"fixed":"21.6.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.11.1-1.module+el8.9.0+21380+12032667"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.11.1-1.module+el8.9.0+21380+12032667"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.11.1-1.module+el8.9.0+21380+12032667"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.11.1-1.module+el8.9.0+21380+12032667"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.11.1-1.module+el8.9.0+21380+12032667"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.11.1-1.module+el8.9.0+21380+12032667"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.9.0+20473+c4e3d824"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.9.0+19519+e25b965a"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.9.0+19519+e25b965a"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.2.4-1.20.11.1.1.module+el8.9.0+21380+12032667"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.11.1-1.module+el9.3.0+21385+bac43d5a"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.11.1-1.module+el9.3.0+21385+bac43d5a"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.11.1-1.module+el9.3.0+21385+bac43d5a"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.11.1-1.module+el9.3.0+21385+bac43d5a"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.11.1-1.module+el9.3.0+21385+bac43d5a"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.11.1-1.module+el9.3.0+21385+bac43d5a"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.3.0.z+20478+84a9f781"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.3.0+19518+63aad52d"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.3.0+19518+63aad52d"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.2.4-1.20.11.1.1.module+el9.3.0+21385+bac43d5a"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.11.1-1.module+el8.9.0+1776+addd4aec"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.8.0+1459+02651ab6"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.7.0+1072+5b168780"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.6.0+32322+a8b1fd01"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.5.0+31770+0da7192d"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.6.0+32045+2e5d342d"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.6.0+32143+ae966e5b"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.6.0+32144+1d29a396"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.6.0+32185+bd121a25"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.5.0+31770+0da7192d"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+32045+2e5d342d"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+32048+5323bb50"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+32143+ae966e5b"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+32144+1d29a396"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+32185+bd121a25"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+32322+a8b1fd01"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP5","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.11.1-150500.11.6.1"}]}],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.11.1-150500.11.6.1"}]}],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.11.1-1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nodejs21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.6.2-1.1"}]}],"bundled":9},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nodejs-electron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"29.4.0-1.1"}]}]}],"products":[{"vendor":"node.js","product":"node.js"},{"vendor":"nodejs","product":"node"},{"vendor":"nodejs","product":"nodejs"}],"references":[{"url":"https://hackerone.com/reports/2170226","tags":["x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2024/03/11/1","tags":["x_transferred","web"]},{"url":"https://security.netapp.com/advisory/ntap-20240517-0007/","tags":["x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-22017","tags":["web","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20240517-0007"},{"url":"https://github.com/advisories/GHSA-vr4q-vx84-9g5x"},{"url":"https://access.redhat.com/errata/RHSA-2024:1687","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-46809","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-21890","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-21891","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-21892","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-21896","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-22017","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-22019","tags":["report"]},{"url":"https://bugzilla.redhat.com/2264569","tags":["report"]},{"url":"https://bugzilla.redhat.com/2264574","tags":["report"]},{"url":"https://bugzilla.redhat.com/2264582","tags":["report"]},{"url":"https://bugzilla.redhat.com/2265717","tags":["report"]},{"url":"https://bugzilla.redhat.com/2265720","tags":["report"]},{"url":"https://bugzilla.redhat.com/2265722","tags":["report"]},{"url":"https://bugzilla.redhat.com/2265727","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2024-1687.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:1688","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2024-1688.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2024-22017","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/advisories/BELL-SA-2024-18","tags":["advisory"]},{"url":"https://github.com/nodejs/node/releases/tag/v20.11.1","tags":["web"]},{"url":"https://github.com/nodejs/node/releases/tag/v21.6.2","tags":["web"]},{"url":"https://nodejs.org/en/blog/vulnerability/february-2024-security-releases#setuid-does-not-drop-all-privileges-due-to-io_uring-cve-2024-22017---high","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2264569","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2264574","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2264582","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2265717","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2265720","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2265722","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2265727","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1687.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-46809","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-46809","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-21890","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-21890","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-21891","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-21891","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-21892","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-21892","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-21896","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-21896","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-22017","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-22019","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-22019","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1688.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:1687","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:1688","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240643-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1219152","tags":["report"]},{"url":"https://bugzilla.suse.com/1219724","tags":["report"]},{"url":"https://bugzilla.suse.com/1219992","tags":["report"]},{"url":"https://bugzilla.suse.com/1219993","tags":["report"]},{"url":"https://bugzilla.suse.com/1219994","tags":["report"]},{"url":"https://bugzilla.suse.com/1219995","tags":["report"]},{"url":"https://bugzilla.suse.com/1219997","tags":["report"]},{"url":"https://bugzilla.suse.com/1219998","tags":["report"]},{"url":"https://bugzilla.suse.com/1219999","tags":["report"]},{"url":"https://bugzilla.suse.com/1220014","tags":["report"]},{"url":"https://bugzilla.suse.com/1220017","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-46809","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-21890","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-21891","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-21892","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-21896","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-22017","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-22019","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-22025","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-24758","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-24806","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2024-22017","tags":["report"]},{"url":"https://nodejs.org/en/blog/vulnerability/february-2024-security-releases/#setuid-does-not-drop-all-privileges-due-to-io_uring-cve-2024-22017---high","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2024/03/11/1","tags":["report"]},{"url":"https://github.com/nodejs/node/commit/42e659cb9d9425f76dbe9b57a437005508c0933d","tags":["report"]},{"url":"https://github.com/nodejs/node/commit/6d14352c51974f0ba1a11e9e4889e61dae9da1f4","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-22017","description":"setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid().\nThis allows the process to perform privileged operations despite presumably having dropped such privileges through a call to setuid().\nThis vulnerability affects all users using version greater or equal than Node.js 18.18.0, Node.js 20.4.0 and Node.js 21.","status":"published","published":"2024-03-19T04:32:34.137Z","modified":"2025-04-30T22:25:14.211Z","cvss":[{"version":"3.0","score":7.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-250"],"updated_at":"2026-11-02T14:34:00.254134Z"}],"euvd":[{"id":"EUVD-2024-19623","description":"setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid().\nThis allows the process to perform privileged operations despite presumably having dropped such privileges through a call to setuid().\nThis vulnerability affects all users using version greater or equal than Node.js 18.18.0, Node.js 20.4.0 and Node.js 21.","status":"published","published":"2024-03-19T04:32:34Z","modified":"2025-04-30T22:25:14Z","cvss":[{"version":"3.0","score":7.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T20:51:58.065214Z"}],"ghsa":[{"id":"GHSA-vr4q-vx84-9g5x","title":"setuid() does not affect libuv's internal io_uring operations if initialized before the call to...","description":"setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid().\nThis allows the process to perform privileged operations despite presumably having dropped such privileges through a call to setuid().\nThis vulnerability affects all users using version greater or equal than Node.js 18.18.0, Node.js 20.4.0 and Node.js 21.","status":"published","published":"2024-03-19T06:30:53Z","modified":"2024-08-15T21:31:19Z","cvss":[{"version":"3.0","score":7.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:L","level":"high"}],"cwes":["CWE-250"],"updated_at":"2026-11-02T14:57:59.133266Z"}],"nvd":[{"id":"CVE-2024-22017","description":"setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid().\nThis allows the process to perform privileged operations despite presumably having dropped such privileges through a call to setuid().\nThis vulnerability affects all users using version greater or equal than Node.js 18.18.0, Node.js 20.4.0 and Node.js 21.","status":"published","published":"2024-03-19T05:15:10.073Z","modified":"2026-06-17T07:10:32.827Z","cvss":[{"version":"3.0","score":7.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:L","level":"high","assessor":"secondary"}],"cwes":["CWE-250"],"updated_at":"2026-11-02T14:09:41.654534Z"}],"osv":[{"id":"BELL-CVE-2024-22017","status":"published","published":"2024-02-16T08:55:10.785053Z","modified":"2026-02-13T07:19:33.016381Z","cvss":[{"version":"3.0","score":7.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:28:19.288949Z"},{"id":"RHSA-2024:1687","title":"Red Hat Security Advisory: nodejs:20 security update","status":"published","published":"2024-10-21T19:41:46Z","modified":"2026-10-09T10:09:47Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"RHSA-2024:1688","title":"Red Hat Security Advisory: nodejs:20 security update","status":"published","published":"2024-10-21T19:41:35Z","modified":"2026-10-09T10:09:48Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"RLSA-2024:1688","title":"Important: nodejs:20 security update","description":"Node.js is a software development platform for building fast and scalable\nnetwork applications in the JavaScript programming language.\n\nSecurity Fix(es):\n\n* nodejs: vulnerable to timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding (Marvin) (CVE-2023-46809)\n\n* nodejs: reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks (CVE-2024-22019)\n\n* nodejs: code injection and privilege escalation through Linux capabilities (CVE-2024-21892)\n\n* nodejs: path traversal by monkey-patching buffer internals (CVE-2024-21896)\n\n* nodejs: multiple permission model bypasses due to improper path traversal sequence sanitization (CVE-2024-21891)\n\n* nodejs: improper handling of wildcards in --allow-fs-read and --allow-fs-write (CVE-2024-21890)\n\n* nodejs: setuid() does not drop all privileges due to io_uring (CVE-2024-22017)","status":"published","published":"2024-05-06T13:05:29.743628Z","modified":"2025-10-09T05:47:25.017548Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:24.63379Z"},{"id":"UBUNTU-CVE-2024-22017","description":"setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid(). This allows the process to perform privileged operations despite presumably having dropped such privileges through a call to setuid(). This vulnerability affects all users using version greater or equal than Node.js 18.18.0, Node.js 20.4.0 and Node.js 21.","status":"withdrawn","published":"2024-03-19T05:15:00Z","modified":"2025-07-14T06:35:42.273998Z","cvss":[{"version":"3.0","score":7.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T16:54:42.68848Z"},{"id":"ALSA-2024:1687","title":"Important: nodejs:20 security update","description":"Node.js is a software development platform for building fast and scalable\nnetwork applications in the JavaScript programming language.\n\nSecurity Fix(es):\n\n* nodejs: vulnerable to timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding (Marvin) (CVE-2023-46809)\n* nodejs: reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks (CVE-2024-22019)\n* nodejs: code injection and privilege escalation through Linux capabilities (CVE-2024-21892)\n* nodejs: path traversal by monkey-patching buffer internals (CVE-2024-21896)\n* nodejs: multiple permission model bypasses due to improper path traversal sequence sanitization (CVE-2024-21891)\n* nodejs: improper handling of wildcards in --allow-fs-read and --allow-fs-write (CVE-2024-21890)\n* nodejs: setuid() does not drop all privileges due to io_uring (CVE-2024-22017)","status":"published","published":"2024-04-08T00:00:00Z","modified":"2026-10-29T11:02:27.678266815Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"ALSA-2024:1688","title":"Important: nodejs:20 security update","description":"Node.js is a software development platform for building fast and scalable\nnetwork applications in the JavaScript programming language.\n\nSecurity Fix(es):\n\n* nodejs: vulnerable to timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding (Marvin) (CVE-2023-46809)\n* nodejs: reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks (CVE-2024-22019)\n* nodejs: code injection and privilege escalation through Linux capabilities (CVE-2024-21892)\n* nodejs: path traversal by monkey-patching buffer internals (CVE-2024-21896)\n* nodejs: multiple permission model bypasses due to improper path traversal sequence sanitization (CVE-2024-21891)\n* nodejs: improper handling of wildcards in --allow-fs-read and --allow-fs-write (CVE-2024-21890)\n* nodejs: setuid() does not drop all privileges due to io_uring (CVE-2024-22017)","status":"published","published":"2024-04-08T00:00:00Z","modified":"2026-10-29T11:31:06.126346705Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"AZL-35886","title":"CVE-2024-22017 affecting package libuv for versions less than 1.48.0-1","description":"setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid().\nThis allows the process to perform privileged operations despite presumably having dropped such privileges through a call to setuid().\nThis vulnerability affects all users using version greater or equal than Node.js 18.18.0, Node.js 20.4.0 and Node.js 21.","status":"published","published":"2024-03-19T05:15:10Z","modified":"2026-04-21T04:33:07.84921Z","updated_at":"2026-11-02T15:28:04.173658Z"},{"id":"AZL-35899","title":"CVE-2024-22017 affecting package nodejs for versions less than 20.14.0-1","description":"setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid().\nThis allows the process to perform privileged operations despite presumably having dropped such privileges through a call to setuid().\nThis vulnerability affects all users using version greater or equal than Node.js 18.18.0, Node.js 20.4.0 and Node.js 21.","status":"published","published":"2024-03-19T05:15:10Z","modified":"2026-04-21T04:33:27.990547Z","updated_at":"2026-11-02T15:28:04.173658Z"},{"id":"BIT-node-2024-22017","description":"setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid().\nThis allows the process to perform privileged operations despite presumably having dropped such privileges through a call to setuid().\nThis vulnerability affects all users using version greater or equal than Node.js 18.18.0, Node.js 20.4.0 and Node.js 21.","status":"published","published":"2024-11-29T14:03:41.826Z","modified":"2026-02-11T09:32:42.468098Z","updated_at":"2026-11-02T15:28:34.007508Z"},{"id":"BIT-node-min-2024-22017","description":"setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid().\nThis allows the process to perform privileged operations despite presumably having dropped such privileges through a call to setuid().\nThis vulnerability affects all users using version greater or equal than Node.js 18.18.0, Node.js 20.4.0 and Node.js 21.","status":"published","published":"2024-12-16T13:55:05.932Z","modified":"2026-02-11T09:32:40.854192Z","updated_at":"2026-11-02T15:28:34.007508Z"},{"id":"openSUSE-SU-2024:13697-1","title":"corepack20-20.11.1-1.1 on GA media","description":"These are all security issues fixed in the corepack20-20.11.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:55:47.667066Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"openSUSE-SU-2024:13698-1","title":"corepack21-21.6.2-1.1 on GA media","description":"These are all security issues fixed in the corepack21-21.6.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:38:16.290264Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"openSUSE-SU-2024:13972-1","title":"nodejs-electron-29.4.0-1.1 on GA media","description":"These are all security issues fixed in the nodejs-electron-29.4.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:08:56.505767Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"RLSA-2024:1687","title":"Important: nodejs:20 security update","description":"Node.js is a software development platform for building fast and scalable\nnetwork applications in the JavaScript programming language.\n\nSecurity Fix(es):\n\n* nodejs: vulnerable to timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding (Marvin) (CVE-2023-46809)\n\n* nodejs: reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks (CVE-2024-22019)\n\n* nodejs: code injection and privilege escalation through Linux capabilities (CVE-2024-21892)\n\n* nodejs: path traversal by monkey-patching buffer internals (CVE-2024-21896)\n\n* nodejs: multiple permission model bypasses due to improper path traversal sequence sanitization (CVE-2024-21891)\n\n* nodejs: improper handling of wildcards in --allow-fs-read and --allow-fs-write (CVE-2024-21890)\n\n* nodejs: setuid() does not drop all privileges due to io_uring (CVE-2024-22017)","status":"published","published":"2024-05-06T13:04:21.002456Z","modified":"2026-02-04T22:45:09.265559Z","updated_at":"2026-11-02T15:53:24.63379Z"},{"id":"SUSE-SU-2024:0643-1","title":"Security update for nodejs20","description":"This update for nodejs20 fixes the following issues:\n\nUpdate to 20.11.1: (security updates)\n\n* CVE-2024-21892: Code injection and privilege escalation through Linux capabilities (bsc#1219992).\n* CVE-2024-22019: http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks (bsc#1219993).\n* CVE-2024-21896: Path traversal by monkey-patching Buffer internals (bsc#1219994).j\n* CVE-2024-22017: setuid() does not drop all privileges due to io_uring (bsc#1219995).\n* CVE-2023-46809: Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) (bsc#1219997).\n* CVE-2024-21891: Multiple permission model bypasses due to improper path traversal sequence sanitization (bsc#1219998).\n* CVE-2024-21890: Improper handling of wildcards in --allow-fs-read and --allow-fs-write (bsc#1219999).\n* CVE-2024-22025: Denial of Service by resource exhaustion in fetch() brotli decoding (bsc#1220014).\n* CVE-2024-24758: undici version 5.28.3 (bsc#1220017).\n* CVE-2024-24806: libuv version 1.48.0 (bsc#1219724).\n\nUpdate to 20.11.0:\n\n* esm: add import.meta.dirname and import.meta.filename\n* fs: add c++ fast path for writeFileSync utf8\n* module: remove useCustomLoadersIfPresent flag\n* module: bootstrap module loaders in shadow realm\n* src: add --disable-warning option\n* src: create per isolate proxy env template\n* src: make process binding data weak\n* stream: use Array for Readable buffer\n* stream: optimize creation\n* test_runner: adds built in lcov reporter\n* test_runner: add Date to the supported mock APIs\n* test_runner, cli: add --test-timeout flag\n\nUpdate to 20.10.0:\n\n* --experimental-default-type flag to flip module defaults\n* The new flag --experimental-detect-module can be used to automatically run ES modules when their syntax can be detected.\n* Added flush option in file system functions for fs.writeFile functions\n* Added experimental WebSocket client\n* vm: fix V8 compilation cache support for vm.Script. This fixes performance regression since v16.x when support for importModuleDynamically was added to vm.Script\n","status":"published","published":"2024-02-28T08:43:43Z","modified":"2026-02-04T04:14:35.479433Z","updated_at":"2026-11-02T15:53:54.239786Z"}]}}