setuid() does not affect libuvs internal io_uring operations if initialized before the call to setuid(). This allows the process to perform privileged operations despite presumably having dropped such privileges through a call to setuid(). This vulnerability affects all users using version greater or equal than Node.js 18.18.0, Node.js 20.4.0 and Node.js 21.
Weakness
The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Red Hat Enterprise Linux 8 | RedHat | nodejs:20-8090020240228165436.a75119d5 | * |
| Red Hat Enterprise Linux 9 | RedHat | nodejs:20-9030020240229115828.rhel9 | * |
| Nodejs | Ubuntu | bionic | * |
| Nodejs | Ubuntu | mantic | * |
| Nodejs | Ubuntu | oracular | * |
| Nodejs | Ubuntu | trusty | * |
| Nodejs | Ubuntu | xenial | * |
Potential Mitigations
Related Attack Patterns
- https://cwe.mitre.org/data/definitions/104.html
- https://cwe.mitre.org/data/definitions/470.html
- https://cwe.mitre.org/data/definitions/69.html