CVE-2024-21892: Code Injection
Node.js could allow a local authenticated attacker to gain elevated privileges on the system, caused by a bug in the implementation of the exception of CAPNETBINDSERVICE. An attacker could exploit this vulnerability to inject code that inherits the process's elevated privileges.
Other sources
On Linux, Node.js ignores certain environment variables if those may have been set by an unprivileged user while the process is running with elevated privileges with the only exception of CAPNETBINDSERVICE. Due to a bug in the implementation of this exception, Node.js incorrectly applies this exception even when certain other capabilities have been set. This allows unprivileged users to inject code that inherits the process's elevated privileges.
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-21892?
CVE-2024-21892 is classified as a high severity vulnerability due to its potential to allow local authenticated attackers to gain elevated privileges.
How do I fix CVE-2024-21892?
To mitigate CVE-2024-21892, update Node.js to versions 18.19.1, 20.11.1, or 21.6.2, or apply the appropriate patches for affected IBM Cognos Analytics releases.
Who is affected by CVE-2024-21892?
CVE-2024-21892 affects users running specific versions of Node.js and IBM Cognos Analytics on Linux systems.
What does CVE-2024-21892 exploit?
CVE-2024-21892 exploits a bug in the implementation of the exception of CAP_NET_BIND_SERVICE in Node.js on Linux.
What are the potential impacts of CVE-2024-21892?
If exploited, CVE-2024-21892 could allow attackers to inject code that inherits elevated privileges from the Node.js process.