Bug 930066 (CVE-2024-32019) – <net-analyzer/netdata-1.45.3: ndsudo - local privilege escalation via untrusted search path

• Product: Gentoo Security
• Status: RESOLVED FIXED

[Description Petr Vaněk 2024-04-15 12:56:18 UTC]

In affected versions the `ndsudo` tool shipped with affected versions of the Netdata Agent allows an attacker to run arbitrary programs with root permissions. The `ndsudo` tool is packaged as a `root`-owned executable with the SUID bit set. It only runs a restricted set of external commands, but its search paths are supplied by the `PATH` environment variable. This allows an attacker to control where `ndsudo` looks for these commands, which may be a path the attacker has write access to. This may lead to local privilege escalation. This vulnerability has been addressed in versions 1.45.3 and 1.45.2-169. Users are advised to upgrade. There are no known workarounds for this vulnerability.

See also: https://github.com/netdata/netdata/security/advisories/GHSA-pmhq-4cxq-wj93

[Comment 1 Larry the Git Cow 2024-04-15 13:44:54 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=2093dfc8d64428ba30f367271407fd9fe4dd2835

commit 2093dfc8d64428ba30f367271407fd9fe4dd2835
Author:     Craig Andrews <[e-mail]>
AuthorDate: 2024-04-15 13:44:17 +0000
Commit:     Craig Andrews <[e-mail]>
CommitDate: 2024-04-15 13:44:23 +0000

    net-analyzer/netdata: add 1.45.3
    
    Bug: https://bugs.gentoo.org/930066
    Signed-off-by: Craig Andrews <[e-mail]>

 net-analyzer/netdata/Manifest              |   1 +
 net-analyzer/netdata/netdata-1.45.3.ebuild | 163 +++++++++++++++++++++++++++++
 2 files changed, 164 insertions(+)

[Comment 2 Larry the Git Cow 2024-04-15 14:11:19 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=6732715cb4cbba421e42a48a1a8c9436bc2888fc

commit 6732715cb4cbba421e42a48a1a8c9436bc2888fc
Author:     Craig Andrews <[e-mail]>
AuthorDate: 2024-04-15 14:10:57 +0000
Commit:     Craig Andrews <[e-mail]>
CommitDate: 2024-04-15 14:11:17 +0000

    net-analyzer/netdata: drop 1.44.0, 1.45.0, 1.45.1, 1.45.2
    
    Bug: https://bugs.gentoo.org/930066
    Signed-off-by: Craig Andrews <[e-mail]>

 net-analyzer/netdata/Manifest              |   4 -
 net-analyzer/netdata/netdata-1.44.0.ebuild | 170 -----------------------------
 net-analyzer/netdata/netdata-1.45.0.ebuild | 155 --------------------------
 net-analyzer/netdata/netdata-1.45.1.ebuild | 155 --------------------------
 net-analyzer/netdata/netdata-1.45.2.ebuild | 163 ---------------------------
 5 files changed, 647 deletions(-)

[Comment 3 Hans de Graaff 2024-04-15 15:25:20 UTC]

All done. Thanks for the quick action!