{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3anetdatanetdata/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:netdata:netdata:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2024-32019"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Netdata (\u003e= 1.44.0-60, \u003c 1.45.0-169 and \u003e= 1.45.0, \u003c 1.45.3)"],"_cs_severities":["high"],"_cs_tags":["privilege-escalation","local-exploitation","linux"],"_cs_type":"advisory","_cs_vendors":["Netdata"],"content_html":"\u003cp\u003eNetdata’s \u003ccode\u003endsudo\u003c/code\u003e helper, which is installed with the SUID bit set, is vulnerable to local privilege escalation (CVE-2024-32019). The utility whitelists specific subcommands for execution but fails to use absolute paths when calling these commands, instead resolving them via the user-controlled \u003ccode\u003ePATH\u003c/code\u003e environment variable. An attacker can place a malicious binary with a whitelisted name (e.g., \u003ccode\u003envme\u003c/code\u003e) into a directory under their control, prepend that directory to the \u003ccode\u003ePATH\u003c/code\u003e variable, and invoke \u003ccode\u003endsudo\u003c/code\u003e to execute the malicious binary with root privileges.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eActor identifies a system running an affected version of Netdata with \u003ccode\u003endsudo\u003c/code\u003e installed as SUID-root.\u003c/li\u003e\n\u003cli\u003eActor identifies a command whitelisted by \u003ccode\u003endsudo\u003c/code\u003e that is not invoked via an absolute path (e.g., \u003ccode\u003envme\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eActor creates a malicious binary and names it to match the targeted whitelisted command.\u003c/li\u003e\n\u003cli\u003eActor creates a writable directory (e.g., \u003ccode\u003e/tmp/fakebin\u003c/code\u003e) and places the malicious binary inside.\u003c/li\u003e\n\u003cli\u003eActor sets execution permissions on the malicious binary.\u003c/li\u003e\n\u003cli\u003eActor modifies the \u003ccode\u003ePATH\u003c/code\u003e environment variable to include the malicious directory at the beginning of the search path.\u003c/li\u003e\n\u003cli\u003eActor executes \u003ccode\u003endsudo\u003c/code\u003e with the target whitelisted subcommand, causing the utility to resolve and execute the malicious binary with root privileges.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation grants a local, low-privileged user (typically members of the \u003ccode\u003enetdata\u003c/code\u003e group) full root access to the affected system.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Netdata to version 1.45.3 (stable) or 1.45.0-169 (nightly) to address the insecure PATH resolution.\u003c/li\u003e\n\u003cli\u003eAudit systems for the presence of the \u003ccode\u003endsudo\u003c/code\u003e binary and ensure appropriate access controls are in place.\u003c/li\u003e\n\u003cli\u003eIf immediate patching is not possible, ensure that users do not have access to execute \u003ccode\u003endsudo\u003c/code\u003e unless strictly required.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-23T18:43:16Z","date_published":"2026-10-23T18:43:16Z","id":"https://feed.craftedsignal.io/briefs/2026-10-netdata-ndsudo-privilege-escalation/","summary":"Netdata’s ndsudo helper utility is vulnerable to local privilege escalation due to insecure PATH-based command resolution, allowing low-privileged users to execute arbitrary code as root.","title":"Netdata: ndsudo local privilege escalation (CVE-2024-32019)","url":"https://feed.craftedsignal.io/briefs/2026-10-netdata-ndsudo-privilege-escalation/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:netdata:netdata:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}