CVE-2024-32019
Netdata is an open source observability tool. In affected versions the `ndsudo` tool shipped with affected versions of the Netdata Agent allows an attacker to run arbitrary programs with root permissions. The `ndsudo` tool is packaged as a `root`-owned executable with the SUID bit set. It only runs a restricted set of external commands, but its search paths are supplied by the `PATH` environment variable. This allows an attacker to control where `ndsudo` looks for these commands, which may be a path the attacker has write access to. This may lead to local privilege escalation. This vulnerability has been addressed in versions 1.45.3 and 1.45.2-169. Users are advised to upgrade. There are no known workarounds for this vulnerability.
EPSS 1.16% · 67.0th percentile
Risk Scores
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| netdata | netdata | >= 1.44.0-60, < 1.45.0-169, >= 1.45.0, < 1.45.3, >= 1.44.0-60, < 1.45.0-169 |
| netdata | netdata | 1.45.0, 1.44.0-60, 1.44.0-60 |
Timeline
- Jan 20, 1970 Fix PR Merged
- Jan 21, 1970 Security Advisory
- Apr 12, 2024 CVE Published
- Apr 13, 2024 EPSS Score
- May 9, 2024 EPSS Score
- Jun 4, 2024 EPSS Score
- Jun 29, 2024 EPSS Score
- Jul 25, 2024 EPSS Score
- Sep 6, 2024 CVE Updated
- Sep 15, 2024 EPSS Score
- Oct 4, 2024 Coalition ESS Score
- Oct 10, 2024 EPSS Score