GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-32019 (GCVE-0-2024-32019)

Vulnerability from cvelistv5 – Published: 2024-04-12 20:33 – Updated: 2024-09-06 17:58
VLAI
Title
ndsudo: local privilege escalation via untrusted search path
Summary
Netdata is an open source observability tool. In affected versions the `ndsudo` tool shipped with affected versions of the Netdata Agent allows an attacker to run arbitrary programs with root permissions. The `ndsudo` tool is packaged as a `root`-owned executable with the SUID bit set. It only runs a restricted set of external commands, but its search paths are supplied by the `PATH` environment variable. This allows an attacker to control where `ndsudo` looks for these commands, which may be a path the attacker has write access to. This may lead to local privilege escalation. This vulnerability has been addressed in versions 1.45.3 and 1.45.2-169. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity
8.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
SSVC
Exploitation: poc Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-08-20 20:53 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
netdata netdata Affected: >= 1.45.0, < 1.45.3
Affected: >= 1.44.0-60, < 1.45.0-169
guessed Create a notification for this product.
netdata netdata Affected: 1.44.0-60 , < 1.45.0-169 (custom)
Affected: 1.45.0 , < 1.45.3 (custom)
    cpe:2.3:a:netdata:netdata:*:*:*:*:*:*:*:*
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T01:59:50.839Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/netdata/netdata/security/advisories/GHSA-pmhq-4cxq-wj93",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/netdata/netdata/security/advisories/GHSA-pmhq-4cxq-wj93"
          },
          {
            "name": "https://github.com/netdata/netdata/pull/17377",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/netdata/netdata/pull/17377"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:netdata:netdata:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "netdata",
            "vendor": "netdata",
            "versions": [
              {
                "lessThan": "1.45.0-169",
                "status": "affected",
                "version": "1.44.0-60",
                "versionType": "custom"
              },
              {
                "lessThan": "1.45.3",
                "status": "affected",
                "version": "1.45.0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-32019",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-20T20:53:45.698496Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-06T17:58:36.095Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "netdata",
          "vendor": "netdata",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.45.0, \u003c 1.45.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.44.0-60, \u003c 1.45.0-169"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Netdata is an open source observability tool. In affected versions the `ndsudo` tool shipped with affected versions of the Netdata Agent allows an attacker to run arbitrary programs with root permissions. The `ndsudo` tool is packaged as a `root`-owned executable with the SUID bit set. It only runs a restricted set of external commands, but its search paths are supplied by the `PATH` environment variable. This allows an attacker to control where `ndsudo` looks for these commands, which may be a path the attacker has write access to. This may lead to local privilege escalation. This vulnerability has been addressed in versions 1.45.3 and 1.45.2-169. Users are advised to upgrade. There are no known workarounds for this vulnerability."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-426",
              "description": "CWE-426: Untrusted Search Path",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-04-12T20:33:18.080Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/netdata/netdata/security/advisories/GHSA-pmhq-4cxq-wj93",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/netdata/netdata/security/advisories/GHSA-pmhq-4cxq-wj93"
        },
        {
          "name": "https://github.com/netdata/netdata/pull/17377",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/netdata/netdata/pull/17377"
        }
      ],
      "source": {
        "advisory": "GHSA-pmhq-4cxq-wj93",
        "discovery": "UNKNOWN"
      },
      "title": "ndsudo: local privilege escalation via untrusted search path"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-32019",
    "datePublished": "2024-04-12T20:33:18.080Z",
    "dateReserved": "2024-04-09T15:29:35.936Z",
    "dateUpdated": "2024-09-06T17:58:36.095Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-32019",
      "date": "2026-09-17",
      "epss": "0.01165",
      "percentile": "0.65756"
    },
    "fkie_nvd": {
      "descriptions": [
        {
          "lang": "en",
          "value": "Netdata is an open source observability tool. In affected versions the `ndsudo` tool shipped with affected versions of the Netdata Agent allows an attacker to run arbitrary programs with root permissions. The `ndsudo` tool is packaged as a `root`-owned executable with the SUID bit set. It only runs a restricted set of external commands, but its search paths are supplied by the `PATH` environment variable. This allows an attacker to control where `ndsudo` looks for these commands, which may be a path the attacker has write access to. This may lead to local privilege escalation. This vulnerability has been addressed in versions 1.45.3 and 1.45.2-169. Users are advised to upgrade. There are no known workarounds for this vulnerability."
        },
        {
          "lang": "es",
          "value": "Netdata es una herramienta de observabilidad de c\u00f3digo abierto. En las versiones afectadas, la herramienta `ndsudo` incluida con las versiones afectadas del Netdata Agent permite a un atacante ejecutar programas arbitrarios con permisos de root. La herramienta `ndsudo` est\u00e1 empaquetada como un ejecutable propiedad de `root` con el bit SUID configurado. Solo ejecuta un conjunto restringido de comandos externos, pero sus rutas de b\u00fasqueda las proporciona la variable de entorno `PATH`. Esto permite a un atacante controlar d\u00f3nde busca `ndsudo` estos comandos, que puede ser una ruta a la que el atacante tiene acceso de escritura. Esto puede conducir a una escalada de privilegios locales. Esta vulnerabilidad se ha solucionado en las versiones 1.45.3 y 1.45.2-169. Se recomienda a los usuarios que actualicen. No se conocen workarounds para esta vulnerabilidad."
        }
      ],
      "id": "CVE-2024-32019",
      "lastModified": "2024-11-21T09:14:20.453",
      "metrics": {
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "CHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
              "version": "3.1"
            },
            "exploitabilityScore": 2.0,
            "impactScore": 6.0,
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      },
      "published": "2024-04-12T21:15:12.133",
      "references": [
        {
          "source": "security-advisories@github.com",
          "url": "https://github.com/netdata/netdata/pull/17377"
        },
        {
          "source": "security-advisories@github.com",
          "url": "https://github.com/netdata/netdata/security/advisories/GHSA-pmhq-4cxq-wj93"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://github.com/netdata/netdata/pull/17377"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://github.com/netdata/netdata/security/advisories/GHSA-pmhq-4cxq-wj93"
        }
      ],
      "sourceIdentifier": "security-advisories@github.com",
      "vulnStatus": "Awaiting Analysis",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-426"
            }
          ],
          "source": "security-advisories@github.com",
          "type": "Secondary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "netdata",
                "vendor": "netdata",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e= 1.45.0, \u003c 1.45.3"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 1.44.0-60, \u003c 1.45.0-169"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          },
          {
            "affectedData": [
              {
                "cpes": [
                  "cpe:2.3:a:netdata:netdata:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "netdata",
                "vendor": "netdata",
                "versions": [
                  {
                    "lessThan": "1.45.0-169",
                    "status": "affected",
                    "version": "1.44.0-60",
                    "versionType": "custom"
                  },
                  {
                    "lessThan": "1.45.3",
                    "status": "affected",
                    "version": "1.45.0",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Netdata is an open source observability tool. In affected versions the `ndsudo` tool shipped with affected versions of the Netdata Agent allows an attacker to run arbitrary programs with root permissions. The `ndsudo` tool is packaged as a `root`-owned executable with the SUID bit set. It only runs a restricted set of external commands, but its search paths are supplied by the `PATH` environment variable. This allows an attacker to control where `ndsudo` looks for these commands, which may be a path the attacker has write access to. This may lead to local privilege escalation. This vulnerability has been addressed in versions 1.45.3 and 1.45.2-169. Users are advised to upgrade. There are no known workarounds for this vulnerability."
          },
          {
            "lang": "es",
            "value": "Netdata es una herramienta de observabilidad de c\u00f3digo abierto. En las versiones afectadas, la herramienta `ndsudo` incluida con las versiones afectadas del Netdata Agent permite a un atacante ejecutar programas arbitrarios con permisos de root. La herramienta `ndsudo` est\u00e1 empaquetada como un ejecutable propiedad de `root` con el bit SUID configurado. Solo ejecuta un conjunto restringido de comandos externos, pero sus rutas de b\u00fasqueda las proporciona la variable de entorno `PATH`. Esto permite a un atacante controlar d\u00f3nde busca `ndsudo` estos comandos, que puede ser una ruta a la que el atacante tiene acceso de escritura. Esto puede conducir a una escalada de privilegios locales. Esta vulnerabilidad se ha solucionado en las versiones 1.45.3 y 1.45.2-169. Se recomienda a los usuarios que actualicen. No se conocen workarounds para esta vulnerabilidad."
          }
        ],
        "id": "CVE-2024-32019",
        "lastModified": "2026-06-17T07:29:07.870",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.0,
              "impactScore": 6.0,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-32019",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-20T20:53:45.698496Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-04-12T21:15:12.133",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/netdata/netdata/pull/17377"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/netdata/netdata/security/advisories/GHSA-pmhq-4cxq-wj93"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://github.com/netdata/netdata/pull/17377"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://github.com/netdata/netdata/security/advisories/GHSA-pmhq-4cxq-wj93"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-426"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2025-11-21T14:46:59+00:00",
      "cve": "CVE-2024-32019",
      "id": "CVE-2024-32019",
      "initial_release_date": "2024-04-12T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "netdata: privilege escalation and command execution",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-32019.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2025-02-16T05:00:40Z",
      "cve": "CVE-2024-32019",
      "id": "CVE-2024-32019",
      "initial_release_date": "2024-04-15T23:12:26Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-32019",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-32019.json",
      "version": "5"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-02T01:59:50.839Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "name": "https://github.com/netdata/netdata/security/advisories/GHSA-pmhq-4cxq-wj93",
                "tags": [
                  "x_refsource_CONFIRM",
                  "x_transferred"
                ],
                "url": "https://github.com/netdata/netdata/security/advisories/GHSA-pmhq-4cxq-wj93"
              },
              {
                "name": "https://github.com/netdata/netdata/pull/17377",
                "tags": [
                  "x_refsource_MISC",
                  "x_transferred"
                ],
                "url": "https://github.com/netdata/netdata/pull/17377"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "affected": [
              {
                "cpes": [
                  "cpe:2.3:a:netdata:netdata:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "netdata",
                "vendor": "netdata",
                "versions": [
                  {
                    "lessThan": "1.45.0-169",
                    "status": "affected",
                    "version": "1.44.0-60",
                    "versionType": "custom"
                  },
                  {
                    "lessThan": "1.45.3",
                    "status": "affected",
                    "version": "1.45.0",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-32019",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-08-20T20:53:45.698496Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-09-03T14:43:02.237Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "netdata",
              "vendor": "netdata",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003e= 1.45.0, \u003c 1.45.3"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 1.44.0-60, \u003c 1.45.0-169"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Netdata is an open source observability tool. In affected versions the `ndsudo` tool shipped with affected versions of the Netdata Agent allows an attacker to run arbitrary programs with root permissions. The `ndsudo` tool is packaged as a `root`-owned executable with the SUID bit set. It only runs a restricted set of external commands, but its search paths are supplied by the `PATH` environment variable. This allows an attacker to control where `ndsudo` looks for these commands, which may be a path the attacker has write access to. This may lead to local privilege escalation. This vulnerability has been addressed in versions 1.45.3 and 1.45.2-169. Users are advised to upgrade. There are no known workarounds for this vulnerability."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-426",
                  "description": "CWE-426: Untrusted Search Path",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2024-04-12T20:33:18.080Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/netdata/netdata/security/advisories/GHSA-pmhq-4cxq-wj93",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/netdata/netdata/security/advisories/GHSA-pmhq-4cxq-wj93"
            },
            {
              "name": "https://github.com/netdata/netdata/pull/17377",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/netdata/netdata/pull/17377"
            }
          ],
          "source": {
            "advisory": "GHSA-pmhq-4cxq-wj93",
            "discovery": "UNKNOWN"
          },
          "title": "ndsudo: local privilege escalation via untrusted search path"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2024-32019",
        "datePublished": "2024-04-12T20:33:18.080Z",
        "dateReserved": "2024-04-09T15:29:35.936Z",
        "dateUpdated": "2024-09-06T17:58:36.095Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.