Bug 2264582 (CVE-2024-21892)

Summary:	CVE-2024-21892 nodejs: code injection and privilege escalation through Linux capabilities
Product:	[Other] Security Response	Reporter:	Robb Gatica <rgatica>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	hhorak, mvanderw, saroy
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	node 18.19.1, node 20.11.1, node 21.6.2	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in Node.js. On Linux, Node.js ignores certain environment variables if an unprivileged user has set them while the process is running with elevated privileges, except for CAP_NET_BIND_SERVICE. Due to a bug in the implementation of this exception, Node.js incorrectly applies this exception even when other capabilities have been set. This flaw allows unprivileged users to inject code that inherits the process's elevated privileges.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2264584, 2264808, 2264809, 2264585, 2264586, 2264810, 2264811
Bug Blocks:	2264565

Description Robb Gatica 2024-02-16 18:02:54 UTC

On Linux, Node.js ignores certain environment variables if those may have been set by an unprivileged user while the process is running with elevated privileges with the only exception of CAP_NET_BIND_SERVICE. Due to a bug in the implementation of this exception, Node.js incorrectly applies this exception even when certain other capabilities have been set. This allows unprivileged users to inject code that inherits the process's elevated privileges.

This vulnerability affects all users in all active release lines: 18.x, 20.x, and 21.x.

References:
https://nodejs.org/en/blog/release/v18.19.1
https://nodejs.org/en/blog/vulnerability/february-2024-security-releases/#code-injection-and-privilege-escalation-through-linux-capabilities-cve-2024-21892---high

Comment 1 Robb Gatica 2024-02-16 18:05:45 UTC

Created nodejs tracking bugs for this issue:

Affects: epel-all [bug 2264584]


Created nodejs18 tracking bugs for this issue:

Affects: fedora-all [bug 2264585]


Created nodejs20 tracking bugs for this issue:

Affects: fedora-all [bug 2264586]

Comment 5 Sandipan Roy 2024-02-19 04:19:53 UTC

Created nodejs16 tracking bugs for this issue:

Affects: fedora-all [bug 2264810]


Created nodejs:13/nodejs tracking bugs for this issue:

Affects: epel-all [bug 2264808]


Created nodejs:16-epel/nodejs tracking bugs for this issue:

Affects: epel-all [bug 2264809]


Created nodejs:16/nodejs tracking bugs for this issue:

Affects: fedora-all [bug 2264811]

Comment 7 errata-xmlrpc 2024-03-26 09:22:50 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:1510 https://access.redhat.com/errata/RHSA-2024:1510

Comment 8 errata-xmlrpc 2024-04-08 08:49:58 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2024:1688 https://access.redhat.com/errata/RHSA-2024:1688

Comment 9 errata-xmlrpc 2024-04-08 09:04:55 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:1687 https://access.redhat.com/errata/RHSA-2024:1687

Comment 10 errata-xmlrpc 2024-04-18 02:08:51 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Extended Update Support

Via RHSA-2024:1880 https://access.redhat.com/errata/RHSA-2024:1880

Comment 11 errata-xmlrpc 2024-04-22 01:09:11 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Extended Update Support

Via RHSA-2024:1932 https://access.redhat.com/errata/RHSA-2024:1932