HIGH 7.3 Microsoft

CVE-2024-22017

setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid(). This allows the process to perform privileged operations despite presumably having dropped such privileges through a call to setuid(). This vulnerability affects all users using version greater or equal than Node.js 18.18.0 Node.js 20.4.0 and Node.js 21.

Microsoft Security Update 2024-Mar: setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid(). This allows the process to perform privileged operations despite presumably having dropped such privileges through a call to setuid(). This vulnerability affects all users using version greater or equal than Node.js 18.18.0 Node.js 20.4.0 and Node.js 21.

Affected Products

References

Published: 2024-03-12 · Source: Microsoft · Feed updated: 2026-08-11
This high severity vulnerability with a CVSS score of 7.3 was published on 2024-03-12 via Microsoft. Affected: azl3 nodejs 20.14.0-1 on Azure Linux 3.0, azl3 libuv 1.48.0-1 on Azure Linux 3.0, azl3 libuv 1.46.0-1 on Azure Linux 3.0 and 1 more.
vulnfeed aggregates 10103 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.