CVE-2024-56330 Session VNC may be accessed by other sessions on the same host in stardust
Attackers can access other containers' agents due to enabled inter-container communication, compromising isolation and data confidentiality.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-56330?
CVE-2024-56330 is a critical missing authorization vulnerability in spaceness stardust, published on 20 Dec 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Stardust is a platform for streaming isolated desktop containers. With this exploit, inter container communication (ICC) is not disabled. This would allow users within a container to access another containers agent, therefore compromising access.The problem has been patched in any Stardust build past 12/20/24. Users are advised to upgrade. Users may also manually disable ICC if they are unable to upgrade.
Weakness: CWE-284
Which versions are affected by CVE-2024-56330?
How do I fix CVE-2024-56330?
No fix has been published for CVE-2024-56330 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-56330 being exploited?
There is no known exploitation of CVE-2024-56330 in the wild and no public exploit code.