Loading HuntDB...

setuid() does not drop all privileges due to io_uring

High
N
Node.js
Submitted None

Team Summary

Official summary from Node.js

`setuid()` does not affect libuv's internal io_uring operations if initialized before the call to `setuid()`. This allows the process to perform privileged operations despite presumably having dropped such privileges through a call to `setuid()`. This vulnerability affects all users using version greater or equal than Node.js 18.18.0, Node.js 20.4.0 and Node.js 21.

Reported by valette

Report Details

Additional information and metadata

State

Closed

Substate

Resolved

Submitted

Weakness

Privilege Escalation