CVE-2024-11584 Privilege escalation in cloud-init

Medium 5.9 Published 26 Jun 2025 Updated 26 Jun 2025

An unprivileged user can trigger hotplug-hook commands via a world-writable socket, potentially leading to privilege escalation or code execution.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2024-11584?

CVE-2024-11584 is a medium-severity vulnerability in Canonical cloud-init, published on 26 Jun 2025. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

cloud-init through 25.1.2 includes the systemd socket unit cloud-init-hotplugd.socket with default SocketMode that grants 0666 permissions, making it world-writable. This is used for the "/run/cloud-init/hook-hotplug-cmd" FIFO. An unprivileged user could trigger hotplug-hook commands.

Weakness: CWE-732

Which versions are affected by CVE-2024-11584?

It affects 1 product.

Products include Canonical Cloud-Init.

How do I fix CVE-2024-11584?

Apply the vendor's patch.

Is CVE-2024-11584 being exploited?

There is no known exploitation of CVE-2024-11584 in the wild and no public exploit code.

Sources

Also known as AZL-64337, AZL-64371, CLSA-2025-1760018787, CLSA-2026-1779098063, CLSA-2026-1791379849, DEBIAN-CVE-2024-11584 and 2 more.