CVE-2024-22017: High severity IBM Cognos Analytics vulnerability
Node.js could allow a local attacker to gain elevated privileges on the system, caused by the failure of setuid() to drop all privileges due to iouring. An attacker could exploit this vulnerability to perform privileged operations.
Other sources
setuid() does not affect libuv's internal iouring operations if initialized before the call to setuid(). This allows the process to perform privileged operations despite presumably having dropped such privileges through a call to setuid(). This vulnerability affects all users using version greater or equal than Node.js 18.18.0 Node.js 20.4.0 and Node.js 21.
— Microsoft
setuid() does not affect libuv's internal iouring operations if initialized before the call to setuid(). This allows the process to perform privileged operations despite presumably having dropped such privileges through a call to setuid(). This vulnerability affects all users using version greater or equal than Node.js 18.18.0, Node.js 20.4.0 and Node.js 21.
— NVD
setuid() does not affect libuv's internal iouring operations if initialized before the call to setuid(). This allows the process to perform privileged operations despite presumably having dropped such privileges through a call to setuid().
Impacts: This vulnerability affects all users in active release lines: 20.x, and 21.x.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-22017?
CVE-2024-22017 has a high severity due to its potential to allow local attackers to gain elevated privileges.
How do I fix CVE-2024-22017?
To fix CVE-2024-22017, update Node.js to version 20.11.1 or apply the relevant patches for affected IBM Cognos Analytics products.
Who is affected by CVE-2024-22017?
CVE-2024-22017 affects systems running Node.js versions prior to 20.11.1 and specific versions of IBM Cognos Analytics.
What are the potential impacts of CVE-2024-22017?
Exploitation of CVE-2024-22017 could lead to unauthorized privileged operations on the affected system.
Is there a workaround for CVE-2024-22017?
There is no specific workaround for CVE-2024-22017; the recommended action is to apply the latest patches or updates.