TI-2024-10733 Aliases CVE-2024-11584 GHSA-3xmh-hrxh-fx8j

Incorrect permission assignment in Canonical cloud-init

LOW 25CWE-732Published 2025-06-26 · Updated 2025-06-26

Key facts

Attack vector: Local
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: Low · Low · Low
Fix status: Partial Red Hat: 4 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

cloud-init through 25.1.2 includes the systemd socket unit cloud-init-hotplugd.socket with default SocketMode that grants 0666 permissions, making it world-writable. This is used for the "/run/cloud-init/hook-hotplug-cmd" FIFO. An unprivileged user could trigger hotplug-hook commands.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00142 3rd percentileScored 2026-11-07

Fix Partial cloud-init (Canonical): 25.1.3Red Hat: 4 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Canonical	cloud-init	21.3 to before 25.1.3	25.1.3	Patch available	CNA

cloud-init VendorCanonical Affected 21.3 to before 25.1.3 Fixed in 25.1.3 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:canonical:cloud-init::::::::	before 25.1.3	Vulnerable	Canonical

cpe:2.3:a:canonical:cloud-init:*:*:*:*:*:*:*:* Versions before 25.1.3 Vulnerable ·Canonical

Remediation

Fix · CNA cloud-init (Canonical) Fixed in 25.1.3

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2025-06-26
Canonical cloud-init 25.1.3
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2024-05723 Improper authentication in Canonical cloud-initPriority MEDIUM 40
Show all 2 records →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 10	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 7	Affected	No fix planned: Out of support scope
Red Hat Enterprise Linux 8	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 9	Affected	No fix yet: Fix deferred

Timeline

2026-10-02 Threatist record created from CVE-2024-11584
2026-10-03 Alias added: GHSA-3xmh-hrxh-fx8j

References

Patch 1

https://github.com/canonical/cloud-init/pull/6265/commits/6e10240a7f0a2d6110b398640b3fd46cfa9a7cf3

Other 1

https://github.com/canonical/cloud-init/releases/tag/25.1.3

TI-2012-05357 Improper privilege management in cloud-init CVSS 3.1HIGH 8.8
TI-2024-05723 Improper authentication in Canonical cloud-init CVSS 3.1HIGH 8.8
TI-2018-07709 The default cloud-init configuration, in cloud-init 0.6.2 and newer, included… CVSS 3.1HIGH 7.1
TI-2020-06920 In cloud-init through 19.4, rand_user_password in cloudinit/config/cc_set_passwords.py… CVSS 3.1MEDIUM 5.5
TI-2020-06919 cloud-init through 19.4 relies on Mersenne Twister for a random password, which makes it… CVSS 3.1MEDIUM 5.5
TI-2023-01678 sensitive data exposure in cloud-init logs CVSS 3.1MEDIUM 5.5

See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences