CVE-2024-6174

An access permissions flaw was found in cloud-init. When a non-x86 platform is detected, cloud-init grants root access to a hardcoded URL with a local IP address, which creates a security exposure.

This vulnerability is Important rather than Moderate because it directly impacts the security boundary between a system’s local environment and potentially untrusted network metadata sources. On non-x86 platforms, the fallback to platform enumeration with default datasource scanning could allow cloud-init to treat a malicious or spoofed local metadata service as authoritative, granting root-level execution of arbitrary user-data or scripts during early boot. Since cloud-init runs before most security controls are active, exploitation would provide persistent and unrestricted system compromise with no user interaction.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.