Vulnerability · Published Jun 26, 2025 · Assigned by canonical
CVE-2024-11584
Medium 5.9
In plain English
A medium-severity incorrect permission assignment in cloud-init from Canonical. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)5.9Medium
Exploit odds (30 days)0.1%top 96.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
cloud-init through 25.1.2 includes the systemd socket unit cloud-init-hotplugd.socket with default SocketMode that grants 0666 permissions, making it world-writable. This is used for the "/run/cloud-init/hook-hotplug-cmd" FIFO. An unprivileged user could trigger hotplug-hook commands.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | cloud-init | 22.4.2-1+deb12u3 | DEBIAN-CVE-2024-11584 |
| Debian:13 | cloud-init | 25.1.4-1 | DEBIAN-CVE-2024-11584 |
| Debian:14 | cloud-init | 25.1.4-1 | DEBIAN-CVE-2024-11584 |
| Ubuntu:22.04:LTS | cloud-init | 25.1.4-0ubuntu0~22.04.1 | USN-7677-1 |
| Ubuntu:22.04:LTS | cloud-init | 25.1.4-0ubuntu0~22.04.1 | UBUNTU-CVE-2024-11584 |
| Ubuntu:24.04:LTS | cloud-init | 25.1.4-0ubuntu0~24.04.1 | USN-7677-1 |
| Ubuntu:24.04:LTS | cloud-init | 25.1.4-0ubuntu0~24.04.1 | UBUNTU-CVE-2024-11584 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Canonical | cloud-init | 21.3 – before 25.1.3 |
Weakness: CWE-732 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L