Canonical Cloud-Init Hotplug Socket World-Writable Vulnerability

A vulnerability in Canonical Cloud-Init versions through 25.1.2 allows for the 'cloud-init-hotplugd.socket' systemd socket unit to be world-writable. The default 'SocketMode' grants 0666 permissions, which could be exploited by an unprivileged user to trigger hotplug-hook commands. This vulnerability arises because the socket listens on a FIFO file that can be manipulated by any user.

Impact

Exploitation of this vulnerability could allow an unprivileged user to execute hotplug-hook commands, potentially leading to unauthorized actions or changes in the system's state.

Remediation

Users can upgrade to Cloud-Init version 25.1.3, where this vulnerability has been addressed. Instructions for downloading this version are available on the Cloud-Init GitHub releases page.