CVE-2024-11584 describes a vulnerability in cloud-init versions through 25.1.2, where the cloud-init-hotplugd.socket systemd unit is configured with world-writable permissions, affecting canonical cloud-init. This misconfiguration allows an unprivileged local user to trigger hotplug-hook commands via the "/run/cloud-init/hook-hotplug-cmd" FIFO. The vulnerability has a CVSS score of 5.3 (Medium), indicating low attack complexity and requiring local user privileges, with potential impacts on confidentiality, integrity, and availability. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 21.3, < 25.1.3CPE match | cpe:2.3:a:canonical:cloud-init:*:*:*:*:*:*:*:* | ||
< 25.1.3CPE matchmatch criteria | cpe:2.3:a:canonical:cloud-init:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
cloud-init: Cloud init permissions handling flaw
Jun 26, 2025cloud-init through 25.1.2 includes the systemd socket unit cloud-init-hotplugd.socket with default SocketMode that grants 0666 permissions, making it world-writable. This is used for the "/run/cloud-init/hook-hotplug-cmd" FIFO. An unprivileged user could trigger hotplug-hook commands.
Jun 10, 2025