CVE-2024-54661

What it actually does

The vulnerability allows exploitation of a predictable temporary file path (/tmp/$USER/stderr2) in readline.sh, enabling race condition attacks that can result in arbitrary file manipulation or code execution with high impact on confidentiality, integrity, and availability.

Why it matters to the business

Potential for full system compromise on affected legacy Ubuntu systems using wpa, though low EPSS score, lack of KEV listing, and no ransomware usage indicate limited immediate operational disruption for most organizations.

How an attack unfolds

An attacker creates a symlink or malicious file at the predictable /tmp path prior to script execution, races the process to redirect stderr or input, and gains elevated access or injects commands.

How to fix it

Upgrade wpa packages to fixed versions: 2.1-0ubuntu1.5 on Ubuntu 14.04 LTS, 2.4-0ubuntu6.2 on Ubuntu 16.04 LTS, and 2.4-0ubuntu10 on Ubuntu 18.04 LTS; additionally update socat to 1.8.0.2 or later where applicable.

How to confirm the fix worked

Verify installed package versions against the listed fixed releases and confirm absence of the vulnerable readline.sh implementation relying on the predictable /tmp path.

Typical attack path

1. Locate systems running vulnerable wpa packages on Ubuntu 14.04/16.04/18.04
2. Prepare symlink or file at /tmp/$USER/stderr2
3. Trigger execution of readline.sh via socat-related functionality
4. Exploit race to achieve file overwrite or command execution

How to detect it

Review system logs for unexpected file operations or symlinks involving /tmp paths during wpa or socat execution, and inspect process activity for anomalous stderr redirection.

What your security team should do

• Prioritize patching legacy Ubuntu systems running wpa to the specified fixed versions
• Audit environments for any remaining use of socat versions before 1.8.0.2
• Monitor for temporary file race indicators in /tmp during script execution