setuid() does not drop all privileges due to io_uring
High
N
Node.js
Submitted None
Team Summary
Official summary from Node.js
`setuid()` does not affect libuv's internal io_uring operations if initialized before the call to `setuid()`. This allows the process to perform privileged operations despite presumably having dropped such privileges through a call to `setuid()`. This vulnerability affects all users using version greater or equal than Node.js 18.18.0, Node.js 20.4.0 and Node.js 21.
Actions:
Reported by
valette
Report Details
Additional information and metadata
State
Closed
Substate
Resolved
Submitted
Weakness
Privilege Escalation