CVE-2024-37325: Azure Science Virtual Machine (DSVM) Elevation of Privilege Vulnerability

Overview

Severity
High (CVSS 8.1)
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
Category
Elevation of Privilege
Exploit Status
Not Exploited
Exploitation Likelihood
Less Likely
Patch Tuesday
2024-Jun
Released
2024-06-11
Last Updated
2024-07-19
EPSS Score
1.77% (percentile: 82.7%)

FAQ

What actions do customers need to take to protect themselves from this vulnerability? Only customers using Linux/Ubuntu Data Science Virtual Machines (DSVM) with versions prior to 24.05.24 may be affected. For guidance on how to update your resources, reference the following: Upgrade your Data Science Virtual Machine to Ubuntu 20.04. Customers who deploy DSVMs using CLI or scripts may also need to update the DSVM version specified in their deployment parameters. How could an attacker exploit this vulnerability? An unauthenticated attacker could send a specially crafted request to the target machine to gain access to credentials of authorized users. This could enable an attacker to impersonate the user and perform any operations the compromised user is permitted to perform. What privileges could be gained by an attacker who successfully exploited the vulnerability? An attacker who successfully exploited this vulnerability could gain the privileges of the compromised user. According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability? Successful exploitation of this vulnerability requires an attacker to gather information specific to the environment of the targeted component.

Affected Products (1)

Azure

  • Azure Data Science Virtual Machines for Linux

Security Updates (1)

Acknowledgments

<a href="https://twitter.com/yanir_">Yanir Tsarimi</a>

Revision History

  • 2024-06-11: Information published.
  • 2024-07-19: The information in the workaround section was updated. This an informational change only.