CVE-2024-22017 setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid(). This allows the process to perform privileged operations despite presumably having dropped suc...
HighCVSS 7.3
EPSS 0.89%
- Published
- Updated
- Exploit status
- No public exploit known
Description
setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid().
This allows the process to perform privileged operations despite presumably having dropped such privileges through a call to setuid().
This vulnerability affects all users using version greater or equal than Node.js 18.18.0, Node.js 20.4.0 and Node.js 21.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| nodejs node | >= 4.0 | No fix listed |
| nodejs node | >= 5.0 | No fix listed |
| nodejs node | >= 6.0 | No fix listed |
| nodejs node | >= 7.0 | No fix listed |
| nodejs node | >= 8.0 | No fix listed |
| nodejs node | >= 9.0 | No fix listed |
| nodejs node | >= 10.0 | No fix listed |
| nodejs node | >= 11.0 | No fix listed |
| nodejs node | >= 12.0 | No fix listed |
| nodejs node | >= 13.0 | No fix listed |
| nodejs node | >= 14.0 | No fix listed |
| nodejs node | >= 15.0 | No fix listed |
| nodejs node | >= 16.0 | No fix listed |
| nodejs node | >= 17.0 | No fix listed |
| nodejs node | >= 19.0 | No fix listed |
| nodejs node | >= 20.0, < 20.11.1 | 20.11.1 |
| nodejs node | >= 21.0, < 21.6.2 | 21.6.2 |
| nodejs | >= 18.0.0, < 18.18.0 | 18.18.0 |
| nodejs | >= 20.0.0, < 20.4.0 | 20.4.0 |
| nodejs | >= 21.0.0, < 21.6.1 | 21.6.1 |