Netdata: ndsudo local privilege escalation (CVE-2024-32019)

Netdata’s ndsudo helper, which is installed with the SUID bit set, is vulnerable to local privilege escalation (CVE-2024-32019). The utility whitelists specific subcommands for execution but fails to use absolute paths when calling these commands, instead resolving them via the user-controlled PATH environment variable. An attacker can place a malicious binary with a whitelisted name (e.g., nvme) into a directory under their control, prepend that directory to the PATH variable, and invoke ndsudo to execute the malicious binary with root privileges.

Attack Chain

1. Actor identifies a system running an affected version of Netdata with ndsudo installed as SUID-root.
2. Actor identifies a command whitelisted by ndsudo that is not invoked via an absolute path (e.g., nvme).
3. Actor creates a malicious binary and names it to match the targeted whitelisted command.
4. Actor creates a writable directory (e.g., /tmp/fakebin) and places the malicious binary inside.
5. Actor sets execution permissions on the malicious binary.
6. Actor modifies the PATH environment variable to include the malicious directory at the beginning of the search path.
7. Actor executes ndsudo with the target whitelisted subcommand, causing the utility to resolve and execute the malicious binary with root privileges.

Impact

Successful exploitation grants a local, low-privileged user (typically members of the netdata group) full root access to the affected system.

Recommendation

• Upgrade Netdata to version 1.45.3 (stable) or 1.45.0-169 (nightly) to address the insecure PATH resolution.
• Audit systems for the presence of the ndsudo binary and ensure appropriate access controls are in place.
• If immediate patching is not possible, ensure that users do not have access to execute ndsudo unless strictly required.