CVE Details

Release Date:2024-02-19


setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid(). This allows the process to perform privileged operations despite presumably having dropped such privileges through a call to setuid(). This vulnerability affects all users using version greater or equal than Node.js 18.18.0, Node.js 20.4.0 and Node.js 21.

See more information about CVE-2024-22017 from MITRE CVE dictionary and NIST NVD

CVSS v3.0 metrics

NOTE: The following CVSS v3.0 metrics and score provided are preliminary and subject to review.

Base Score: 7.3 Base Metrics: AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Access Vector: Local network Attack Complexity: Low
Privileges Required: Low User Interaction: Required
Scope: Unchanged Confidentiality Impact: High
Integrity Impact: High Availability Impact: High

Errata information

PlatformErrataRelease Date
Oracle Linux version 8 (nodejs)ELSA-2024-16872024-04-08
Oracle Linux version 8 (nodejs-nodemon)ELSA-2024-16872024-04-08
Oracle Linux version 8 (nodejs-packaging)ELSA-2024-16872024-04-08
Oracle Linux version 9 (nodejs)ELSA-2024-16882024-04-08
Oracle Linux version 9 (nodejs-nodemon)ELSA-2024-16882024-04-08
Oracle Linux version 9 (nodejs-packaging)ELSA-2024-16882024-04-08

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team