CVE-2024-22017
Fixed in a distro release EPSS <1%CVSS 7.3
setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid(). This allows the process to perform privileged operations despite presumably having dropped such privileges through a call to setuid(). This vulnerability affects all users using version greater or equal than Node.js 18.18.0, Node.js 20.4.0 and Node.js 21.
Products: NodeJS Node, nodejs
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 8 | nodejs | 1:20.11.1-1.module_el8.9.0+3775+d8460d35 |
| AlmaLinux 8 | nodejs-devel | 1:20.11.1-1.module_el8.9.0+3775+d8460d35 |
| AlmaLinux 8 | nodejs-docs | 1:20.11.1-1.module_el8.9.0+3775+d8460d35 |
| AlmaLinux 8 | nodejs-full-i18n | 1:20.11.1-1.module_el8.9.0+3775+d8460d35 |
| AlmaLinux 8 | nodejs-nodemon | 3.0.1-1.module_el8.9.0+3731+490e3ce5 |
| AlmaLinux 8 | nodejs-packaging | 2021.06-4.module_el8.9.0+3684+11b9e959 |
| AlmaLinux 8 | nodejs-packaging-bundler | 2021.06-4.module_el8.9.0+3684+11b9e959 |
| AlmaLinux 8 | npm | 1:10.2.4-1.20.11.1.1.module_el8.9.0+3775+d8460d35 |
| AlmaLinux 9 | nodejs | 1:20.11.1-1.module_el9.3.0+88+29afeaa2 |
| AlmaLinux 9 | nodejs-devel | 1:20.11.1-1.module_el9.3.0+88+29afeaa2 |
| AlmaLinux 9 | nodejs-docs | 1:20.11.1-1.module_el9.3.0+88+29afeaa2 |
| AlmaLinux 9 | nodejs-full-i18n | 1:20.11.1-1.module_el9.3.0+88+29afeaa2 |
| AlmaLinux 9 | nodejs-nodemon | 3.0.1-1.module_el9.3.0+47+c33bc288 |
| AlmaLinux 9 | nodejs-packaging | 2021.06-4.module_el9.3.0+48+1cf146a1 |
| AlmaLinux 9 | nodejs-packaging-bundler | 2021.06-4.module_el9.3.0+48+1cf146a1 |
| AlmaLinux 9 | npm | 1:10.2.4-1.20.11.1.1.module_el9.3.0+88+29afeaa2 |
| Red Hat Enterprise Linux 8 | nodejs | 1:20.11.1-1.module+el8.9.0+21380+12032667 |
| Red Hat Enterprise Linux 8 | nodejs-debuginfo | 1:20.11.1-1.module+el8.9.0+21380+12032667 |
| Red Hat Enterprise Linux 8 | nodejs-debugsource | 1:20.11.1-1.module+el8.9.0+21380+12032667 |
| Red Hat Enterprise Linux 8 | nodejs-devel | 1:20.11.1-1.module+el8.9.0+21380+12032667 |
| Red Hat Enterprise Linux 8 | nodejs-docs | 1:20.11.1-1.module+el8.9.0+21380+12032667 |
| Red Hat Enterprise Linux 8 | nodejs-full-i18n | 1:20.11.1-1.module+el8.9.0+21380+12032667 |
| Red Hat Enterprise Linux 8 | nodejs-nodemon | 0:3.0.1-1.module+el8.9.0+20473+c4e3d824 |
| Red Hat Enterprise Linux 8 | nodejs-packaging | 0:2021.06-4.module+el8.9.0+19519+e25b965a |
| Red Hat Enterprise Linux 8 | nodejs-packaging-bundler | 0:2021.06-4.module+el8.9.0+19519+e25b965a |
| Red Hat Enterprise Linux 8 | npm | 1:10.2.4-1.20.11.1.1.module+el8.9.0+21380+12032667 |
| Red Hat Enterprise Linux 9 | nodejs | 1:20.11.1-1.module+el9.3.0+21385+bac43d5a |
| Red Hat Enterprise Linux 9 | nodejs-debuginfo | 1:20.11.1-1.module+el9.3.0+21385+bac43d5a |
| Red Hat Enterprise Linux 9 | nodejs-debugsource | 1:20.11.1-1.module+el9.3.0+21385+bac43d5a |
| Red Hat Enterprise Linux 9 | nodejs-devel | 1:20.11.1-1.module+el9.3.0+21385+bac43d5a |
| Red Hat Enterprise Linux 9 | nodejs-docs | 1:20.11.1-1.module+el9.3.0+21385+bac43d5a |
| Red Hat Enterprise Linux 9 | nodejs-full-i18n | 1:20.11.1-1.module+el9.3.0+21385+bac43d5a |
| Red Hat Enterprise Linux 9 | nodejs-nodemon | 0:3.0.1-1.module+el9.3.0.z+20478+84a9f781 |
| Red Hat Enterprise Linux 9 | nodejs-packaging | 0:2021.06-4.module+el9.3.0+19518+63aad52d |
| Red Hat Enterprise Linux 9 | nodejs-packaging-bundler | 0:2021.06-4.module+el9.3.0+19518+63aad52d |
| Red Hat Enterprise Linux 9 | npm | 1:10.2.4-1.20.11.1.1.module+el9.3.0+21385+bac43d5a |
| Rocky Linux 8 | nodejs | 1:20.11.1-1.module+el8.9.0+1776+addd4aec |
| Rocky Linux 8 | nodejs-nodemon | 0:3.0.1-1.module+el8.8.0+1459+02651ab6 |
| Rocky Linux 8 | nodejs-packaging | 0:2021.06-4.module+el8.7.0+1072+5b168780 |
| Rocky Linux 9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32322+a8b1fd01 |
| Rocky Linux 9 | nodejs-nodemon | 0:3.0.1-1.module+el9.5.0+31770+0da7192d |
| Rocky Linux 9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32045+2e5d342d |
| Rocky Linux 9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32143+ae966e5b |
| Rocky Linux 9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32144+1d29a396 |
| Rocky Linux 9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32185+bd121a25 |
| Rocky Linux 9 | nodejs-packaging | 0:2021.06-4.module+el9.5.0+31770+0da7192d |
| Rocky Linux 9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32045+2e5d342d |
| Rocky Linux 9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32048+5323bb50 |
| Rocky Linux 9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32143+ae966e5b |
| Rocky Linux 9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32144+1d29a396 |
| Rocky Linux 9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32185+bd121a25 |
| Rocky Linux 9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32322+a8b1fd01 |
| SUSE Linux Enterprise Module for Web and Scripting 15 SP5 | nodejs20 | 20.11.1-150500.11.6.1 |
| Ubuntu 25.04 | nodejs | 20.18.1+dfsg-1ubuntu2 |
| openSUSE Leap 15.5 | nodejs20 | 20.11.1-150500.11.6.1 |
| openSUSE Tumbleweed | nodejs-electron | 29.4.0-1.1 |
| openSUSE Tumbleweed | nodejs20 | 20.11.1-1.1 |
| openSUSE Tumbleweed | nodejs21 | 21.6.2-1.1 |