Netdata (>= 1.44.0-60, < 1.45.0-169 and >= 1.45.0, < 1.45.3) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/netdata--1.44.0-60--1.45.0-169-and--1.45.0--1.45.3/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 23 Oct 2026 18:43:16 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgNetdata: ndsudo local privilege escalation (CVE-2024-32019)https://feed.craftedsignal.io/briefs/2026-10-netdata-ndsudo-privilege-escalation/Fri, 23 Oct 2026 18:43:16 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-netdata-ndsudo-privilege-escalation/Netdata’s ndsudo helper utility is vulnerable to local privilege escalation due to insecure PATH-based command resolution, allowing low-privileged users to execute arbitrary code as root.Netdata’s ndsudo helper, which is installed with the SUID bit set, is vulnerable to local privilege escalation (CVE-2024-32019). The utility whitelists specific subcommands for execution but fails to use absolute paths when calling these commands, instead resolving them via the user-controlled PATH environment variable. An attacker can place a malicious binary with a whitelisted name (e.g., nvme) into a directory under their control, prepend that directory to the PATH variable, and invoke ndsudo to execute the malicious binary with root privileges.

Attack Chain

  1. Actor identifies a system running an affected version of Netdata with ndsudo installed as SUID-root.
  2. Actor identifies a command whitelisted by ndsudo that is not invoked via an absolute path (e.g., nvme).
  3. Actor creates a malicious binary and names it to match the targeted whitelisted command.
  4. Actor creates a writable directory (e.g., /tmp/fakebin) and places the malicious binary inside.
  5. Actor sets execution permissions on the malicious binary.
  6. Actor modifies the PATH environment variable to include the malicious directory at the beginning of the search path.
  7. Actor executes ndsudo with the target whitelisted subcommand, causing the utility to resolve and execute the malicious binary with root privileges.

Impact

Successful exploitation grants a local, low-privileged user (typically members of the netdata group) full root access to the affected system.

Recommendation

  • Upgrade Netdata to version 1.45.3 (stable) or 1.45.0-169 (nightly) to address the insecure PATH resolution.
  • Audit systems for the presence of the ndsudo binary and ensure appropriate access controls are in place.
  • If immediate patching is not possible, ensure that users do not have access to execute ndsudo unless strictly required.
]]>highadvisoryprivilege-escalationlocal-exploitationlinux