CVE-2024-22017 describes a privilege escalation vulnerability in libuv, affecting Node.js versions 18.18.0+, 20.4.0+, and 21. If libuv's io_uring operations are initialized before a setuid() call, the process can retain privileged access despite ostensibly dropping privileges. This vulnerability carries a CVSS score of 7.3 (HIGH), indicating a local attack vector with low complexity, requiring high privileges, and potentially leading to limited confidentiality, high integrity, and limited availability impacts. Currently, there is no evidence of active exploitation, public exploit code, or significant community discussion or media coverage surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 20.0, < 20.11.1CPE match | cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:* | ||
>= 21.0, < 21.6.2CPE match | cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:L
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
CVE-2024-22017
Jun 11, 2024setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid(). This allows the process to perform privileged operations despite presumably having dropped such privileges through a call to setuid(). This vulnerability affects all users using version greater or equal than Node.js 18.18.0 Node.js 20.4.0 and Node.js 21.
Mar 12, 2024nodejs: setuid() does not drop all privileges due to io_uring
Feb 19, 2024