CVE-2024-22017

Name	CVE-2024-22017
Description	setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid(). This allows the process to perform privileged operations despite presumably having dropped such privileges through a call to setuid(). This vulnerability affects all users using version greater or equal than Node.js 18.18.0, Node.js 20.4.0 and Node.js 21.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
nodejs (PTS)	bullseye	12.22.12~dfsg-1~deb11u4	fixed
	bullseye (security)	12.22.12~dfsg-1~deb11u7	fixed
	bookworm, bookworm (security)	18.20.4+dfsg-1~deb12u1	fixed
	forky, trixie	20.19.2+dfsg-1	fixed
	sid	20.19.4+dfsg-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
nodejs	source	experimental	(unfixed)
nodejs	source	(unstable)	(not affected)

Notes

- nodejs <not-affected> (Only affects 20.x and later)
https://nodejs.org/en/blog/vulnerability/february-2024-security-releases/#setuid-does-not-drop-all-privileges-due-to-io_uring-cve-2024-22017---high