Description (CNA)
setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid(). This allows the process to perform privileged operations despite presumably having dropped such privileges through a call to setuid(). This vulnerability affects all users using version greater or equal than Node.js 18.18.0, Node.js 20.4.0 and Node.js 21.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| NodeJS / Node | affected 4.0 before 4.*; affected 5.0 before 5.*; affected 6.0 before 6.*; affected 7.0 before 7.*; affected 8.0 before 8.*; affected 9.0 before 9.*; affected 10.0 before 10.*; affected 11.0 before 11.*; affected 12.0 before 12.*; affected 13.0 before 13.*; affected 14.0 before 14.*; affected 15.0 before 15.*; affected 16.0 before 16.*; affected 17.0 before 17.*; affected 19.0 before 19.*; affected 20.0 before 20.11.1; affected 21.0 before 21.6.2 |
CWE
No CWE identifiers supplied.
References
- https://hackerone.com/reports/2170226
- http://www.openwall.com/lists/oss-security/2024/03/11/1
- https://security.netapp.com/advisory/ntap-20240517-0007/
ADP enrichment
No English description supplied.
No English description supplied.
No references supplied.