CVE-2024-11584 in cloud-init
Summary
by MITRE • 06/26/2025
cloud-init through 25.1.2 includes the systemd socket unit cloud-init-hotplugd.socket with default SocketMode that grants 0666 permissions, making it world-writable. This being used for the "/run/cloud-init/hook-hotplug-cmd" FIFO. An unprivelege user could trigger hotplug-hook commands.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/05/2025
The vulnerability identified as CVE-2024-11584 affects cloud-init versions through 25.1.2 and stems from improper permission configuration in the systemd socket unit cloud-init-hotplugd.socket. This flaw creates a security risk by granting world-writable permissions through the default SocketMode setting of 0666, which allows any unprivileged user to interact with the system's hotplug hook mechanism. The issue specifically impacts the "/run/cloud-init/hook-hotplug-cmd" FIFO (First In, First Out) communication channel that serves as the interface for hotplug hook commands within the cloud-init framework.
The technical implementation of this vulnerability involves the cloud-init daemon's handling of hardware hotplug events through a dedicated socket-based communication system. When the cloud-init-hotplugd.socket unit is initialized with 0666 permissions, it creates a security boundary failure where any local user can write to the socket and potentially trigger arbitrary hotplug hook commands. This represents a classic privilege escalation vector through improper access control mechanisms and violates the principle of least privilege that should govern all system components. The vulnerability is categorized under CWE-276, which addresses improper permissions and access control, specifically focusing on inadequate file and socket permissions that allow unauthorized access to system resources.
The operational impact of this vulnerability extends beyond simple privilege escalation as it enables unprivileged users to execute potentially dangerous operations within the cloud-init framework. Attackers could leverage this flaw to manipulate system configuration, inject malicious commands, or disrupt normal system operations through the hotplug hook mechanism. The attack surface is particularly concerning in multi-tenant cloud environments where isolation between users is critical, as a single compromised low-privilege account could potentially affect system integrity and availability. This vulnerability directly maps to ATT&CK technique T1068, which covers local privilege escalation through the exploitation of system-level access control weaknesses.
Mitigation strategies for CVE-2024-11584 should prioritize immediate patching of affected cloud-init versions to 25.1.3 or later, where the socket permissions have been corrected. System administrators should also implement additional monitoring of the /run/cloud-init/hook-hotplug-cmd FIFO and associated socket files for unauthorized access attempts. Configuration management should enforce stricter permission settings on systemd socket units and ensure that all cloud-init components follow secure-by-default principles. Organizations should conduct thorough security audits of their cloud-init configurations and implement network segmentation to limit potential exploitation. The remediation process should include verifying that socket permissions are set to appropriate restrictive values such as 0600 or 0640, ensuring that only authorized processes can access the hotplug hook communication channel while maintaining proper functionality for legitimate system operations.