{"answers":{"affected":"3 open source packages ship an affected version, including github.com/kolide/launcher.","exploited":"There is no known exploitation of CVE-2024-54131 in the wild and no public exploit code.","fix":"Upgrade github.com/kolide/launcher to 1.12.3 or later.","what":"CVE-2024-54131 is a high-severity vulnerability in kolide launcher, published on 3 Dec 2024. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2024-54131 and fix it if it is affected.\n\nWhat it is: CVE-2024-54131 is a high-severity vulnerability in kolide launcher, published on 3 Dec 2024. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2024-54131 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- github.com/kolide/launcher (Go): affected from 1.5.3; fixed in 1.12.3\n- github.com/kolide/launcher (Go): affected from 1.5.3; fixed in 1.12.3\n- github.com/kolide/launcher (Go): affected from 1.5.3; fixed in 1.12.3\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2024-54131/ (Markdown: https://insights.sbomify.com/CVE-2024-54131/index.md)","id":"CVE-2024-54131","markdown":"https://insights.sbomify.com/CVE-2024-54131/index.md","name":"CVE-2024-54131","record":{"aliases":["GHSA-66q9-2rvx-qfj5","GO-2024-3308"],"analysis":{"component_type":"desktop_application","fix_type":"upgrade","impacts":["privilege_escalation","code_execution"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Kolide Agent","requires_auth":"low_privilege","summary":"Local attackers can escalate privileges to SYSTEM on Windows by placing a malicious DLL in the agent's search path due to insecure default permissions.","user_interaction":"not_required","vuln_class":"privilege_escalation"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[],"cvss":{"score":7.3,"severity":"high","source":"cna","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","version":"4.0"},"cwes":[{"id":"CWE-456","name":"Missing Initialization of a Variable"},{"id":"CWE-276","name":"Incorrect Default Permissions"}],"description":"The Kolide Agent (aka: Launcher) is the lightweight agent designed to work with Kolide's service. An implementation bug in the Kolide Agent (known as `launcher`) allows for local privilege escalation to the SYSTEM user on Windows 10 and 11. The bug was introduced in version 1.5.3 when launcher started storing upgraded binaries in the ProgramData directory. This move to the new directory meant the launcher root directory inherited default permissions that are not as strict as the previous location. These incorrect default permissions in conjunction with an omitted SystemDrive environmental variable (when launcher starts osqueryd), allows a malicious actor with access to the local Windows device to successfully place an arbitrary DLL into the osqueryd process's search path. Under some circumstances, this DLL will be executed when osqueryd performs a WMI query. This combination of events could then allow the attacker to escalate their privileges to SYSTEM. Impacted versions include versions \u003e= 1.5.3 and the fix has been released in 1.12.3.","ecosystems":["Go"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Kolide Agent Privilege Escalation (Windows, Versions \u003e= 1.5.3, \u003c 1.12.3)","id":"CVE-2024-54131","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Go","product":null,"products":[],"type":"privilege_escalation","year":"2024"},"n_packages":3,"n_references":2,"next":{"headline":"GitHub CLI allows downloading malicious GitHub Actions workflow artifact to result in path traversal vulnerability","id":"CVE-2024-54132"},"packages":[{"ecosystem":"Go","fixed":["1.12.3"],"introduced":["1.5.3"],"last_affected":[],"package":"github.com/kolide/launcher","purl":null,"source":"GHSA-66q9-2rvx-qfj5"},{"ecosystem":"Go","fixed":["1.12.3"],"introduced":["1.5.3"],"last_affected":[],"package":"github.com/kolide/launcher","purl":"pkg:golang/github.com/kolide/launcher","source":"GHSA-66q9-2rvx-qfj5"},{"ecosystem":"Go","fixed":["1.12.3"],"introduced":["1.5.3"],"last_affected":[],"package":"github.com/kolide/launcher","purl":"pkg:golang/github.com/kolide/launcher","source":"GO-2024-3308"}],"prev":{"headline":"Segmentation Fault in `forwardBundle` Function of ION-DTN BPv7 When Destination EID is `dtn:none` (public)","id":"CVE-2024-54130"},"products":["launcher"],"published":"2024-12-03","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"Go Vulnerability Database","prefix":"GO"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2024-12-03","vendors":["kolide"]},"summary":"Local attackers can escalate privileges to SYSTEM on Windows by placing a malicious DLL in the agent's search path due to insecure default permissions.","url":"https://insights.sbomify.com/CVE-2024-54131/"}