Root Access Vulnerability in Cloud-Init by Canonical on Non-x86 Platforms
CVE-2024-6174

8.8HIGH

Key Information:

Vendor

Canonical

Status
Cloud-init
Vendor
CVE Published:
26 June 2025

What is CVE-2024-6174?

Cloud-Init has a vulnerability that allows root access to a hardcoded URL when a non-x86 platform is detected. This occurs due to insufficient control measures within the default configurations, which can potentially expose sensitive resources. To mitigate this risk, it's recommended that administrators ensure proper configurations are set to disable platform enumeration within Cloud-Init.

Affected Version(s)

cloud-init Linux 0.7.9 < 25.1.3

References

https://github.com/canonical/cloud-init/releases/tag/25.1.3

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2024-6174 : Root Access Vulnerability in Cloud-Init by Canonical on Non-x86 Platforms