Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 930066 (CVE-2024-32019)

Summary: <net-analyzer/netdata-1.45.3: ndsudo - local privilege escalation via untrusted search path
Product: Gentoo Security Reporter: Petr Vaněk <arkamar>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Status: RESOLVED FIXED    
Severity: normal CC: candrews
Priority: Normal    
Version: unspecified   
Hardware: All   
OS: Linux   
Whiteboard: ~1 [noglsa]
Package list:
Runtime testing required: ---

Description Petr Vaněk gentoo-dev 2024-04-15 12:56:18 UTC
In affected versions the `ndsudo` tool shipped with affected versions of the Netdata Agent allows an attacker to run arbitrary programs with root permissions. The `ndsudo` tool is packaged as a `root`-owned executable with the SUID bit set. It only runs a restricted set of external commands, but its search paths are supplied by the `PATH` environment variable. This allows an attacker to control where `ndsudo` looks for these commands, which may be a path the attacker has write access to. This may lead to local privilege escalation. This vulnerability has been addressed in versions 1.45.3 and 1.45.2-169. Users are advised to upgrade. There are no known workarounds for this vulnerability.

See also: https://github.com/netdata/netdata/security/advisories/GHSA-pmhq-4cxq-wj93
Comment 1 Larry the Git Cow gentoo-dev 2024-04-15 13:44:54 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=2093dfc8d64428ba30f367271407fd9fe4dd2835

commit 2093dfc8d64428ba30f367271407fd9fe4dd2835
Author:     Craig Andrews <candrews@gentoo.org>
AuthorDate: 2024-04-15 13:44:17 +0000
Commit:     Craig Andrews <candrews@gentoo.org>
CommitDate: 2024-04-15 13:44:23 +0000

    net-analyzer/netdata: add 1.45.3
    
    Bug: https://bugs.gentoo.org/930066
    Signed-off-by: Craig Andrews <candrews@gentoo.org>

 net-analyzer/netdata/Manifest              |   1 +
 net-analyzer/netdata/netdata-1.45.3.ebuild | 163 +++++++++++++++++++++++++++++
 2 files changed, 164 insertions(+)
Comment 2 Larry the Git Cow gentoo-dev 2024-04-15 14:11:19 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=6732715cb4cbba421e42a48a1a8c9436bc2888fc

commit 6732715cb4cbba421e42a48a1a8c9436bc2888fc
Author:     Craig Andrews <candrews@gentoo.org>
AuthorDate: 2024-04-15 14:10:57 +0000
Commit:     Craig Andrews <candrews@gentoo.org>
CommitDate: 2024-04-15 14:11:17 +0000

    net-analyzer/netdata: drop 1.44.0, 1.45.0, 1.45.1, 1.45.2
    
    Bug: https://bugs.gentoo.org/930066
    Signed-off-by: Craig Andrews <candrews@gentoo.org>

 net-analyzer/netdata/Manifest              |   4 -
 net-analyzer/netdata/netdata-1.44.0.ebuild | 170 -----------------------------
 net-analyzer/netdata/netdata-1.45.0.ebuild | 155 --------------------------
 net-analyzer/netdata/netdata-1.45.1.ebuild | 155 --------------------------
 net-analyzer/netdata/netdata-1.45.2.ebuild | 163 ---------------------------
 5 files changed, 647 deletions(-)
Comment 3 Hans de Graaff gentoo-dev Security 2024-04-15 15:25:20 UTC
All done. Thanks for the quick action!