CVE-2024-32019

What it actually does

The ndsudo binary is installed SUID root and invokes external commands whose locations are resolved via the untrusted PATH environment variable, allowing a local attacker to substitute a malicious executable for any of the restricted commands it supports and thereby execute arbitrary code as root.

Why it matters to the business

Attackers with a local shell on a Netdata host can obtain root privileges, resulting in complete system takeover, data exfiltration, persistence, and lateral movement; the vulnerability has been publicly weaponized and affects a widely deployed open-source observability agent.

How an attack unfolds

An attacker with a local account creates a writable directory containing a malicious binary whose name matches one of the commands ndsudo is allowed to invoke, prepends that directory to PATH, then executes the ndsudo binary; because ndsudo is SUID root it runs the attacker-controlled binary with root privileges, achieving local privilege escalation. Public weaponization of the technique has been observed.

How to fix it

Upgrade Netdata to a build containing commit 59ee49c63212596c79cf7cdaf9b7e0167f1c1739 (versions 1.45.3 or 1.45.2-169) or later; after upgrade verify that the ndsudo binary no longer has the SUID bit set or that its search paths have been hardened to absolute locations.

How to confirm the fix worked

Confirm the installed Netdata version or commit hash matches or exceeds the fixed revision; run 'ls -l $(which ndsudo)' to verify the SUID bit is absent on the new binary; attempt a PATH manipulation test in a non-production environment to ensure the vulnerability is closed.

Typical attack path

1. Obtain a local shell on a host running a vulnerable Netdata Agent
2. Create a directory writable by the attacker and place a malicious executable matching an allowed command name inside it
3. Export a PATH that places the attacker-controlled directory first
4. Invoke the ndsudo binary (which is SUID root) with the chosen command name
5. The malicious binary executes as root, completing privilege escalation

How to detect it

Search process execution logs and audit trails for invocations of ndsudo preceded by PATH environment changes or originating from non-standard directories; inspect shell history and sudo logs for sequences that prepend attacker-writable paths before calling ndsudo.

• /usr/libexec/netdata/ndsudo
• ndsudo
• PATH=.*:/tmp/.* ndsudo
• SUID ndsudo execution from non-root user

What your security team should do

• Immediately upgrade all Netdata Agents to a fixed build containing commit 59ee49c63212596c79cf7cdaf9b7e0167f1c1739
• Audit systems for the presence of the SUID ndsudo binary and remove the bit if the package cannot be upgraded promptly
• Add monitoring for unexpected executions of ndsudo or unusual PATH values in user sessions
• Review and restrict local accounts that can reach the ndsudo binary