CVE-2024-57360 Missing authorization in n/a
Local attackers can bypass access controls in the nm tool to read restricted symbol version information.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-57360?
CVE-2024-57360 is a medium-severity missing authorization vulnerability in n/a, published on 21 Jan 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
https://www.gnu.org/software/binutils/ nm >=2.43 is affected by: Incorrect Access Control. The type of exploitation is: local. The component is: `nm --without-symbol-version` function.
Weakness: CWE-284
Which versions are affected by CVE-2024-57360?
How do I fix CVE-2024-57360?
Upgrade to a fixed version.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-57360 being exploited?
There is no known exploitation of CVE-2024-57360 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2024-57360, DEBIAN-CVE-2024-57360, ECHO-7b77-fb58-c2b2, GHSA-cwjw-x748-4mm6, ROOT-OS-DEBIAN-12-CVE-2024-57360, UBUNTU-CVE-2024-57360.