CVE catalog
CVE-2024-6174
cloud-init vulnerabilities
- Severity
- High · CVSS 8.8
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.26% · Oct 25, 2026
When a non-x86 platform is detected, cloud-init grants root access to a hardcoded url with a local IP address. To prevent this, cloud-init default configurations disable platform enumeration.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | cloud-init | sid | 26.2-1 | fixed |
| Debian | cloud-init | forky | 26.2-1 | fixed |
| Debian | cloud-init | trixie | 25.1.4-1+deb13u1 | fixed |
| Debian | cloud-init | bookworm | 22.4.2-1+deb12u4 | fixed |
| Ubuntu | cloud-init | noble | 22.4.2-1+deb12u3 | fixed |
| Ubuntu | cloud-init | noble | 25.1.4-0ubuntu0~24.04.1 | fixed |
| Ubuntu | cloud-init | pro | 19.2-36-g059d049c-0ubuntu3 | vulnerable |
| Ubuntu | cloud-init | pro | 19.2-78-ge8138959-0ubuntu1 | vulnerable |
| Ubuntu | cloud-init | pro | 19.3-0ubuntu1 | vulnerable |
| Ubuntu | cloud-init | pro | 19.3-23-gfb04493e-0ubuntu1 | vulnerable |
| Ubuntu | cloud-init | pro | 19.3-30-g4bc399e0-0ubuntu1 | vulnerable |
| Ubuntu | cloud-init | pro | 19.3-40-gf69d33a7-0ubuntu1 | vulnerable |
| Ubuntu | cloud-init | pro | 19.3-41-gc4735dd3-0ubuntu1 | vulnerable |
| Ubuntu | cloud-init | pro | 19.3-74-g129b1c4e-0ubuntu1 | vulnerable |
| Ubuntu | cloud-init | pro | 19.4-1-g8c96cbc1-0ubuntu1 | vulnerable |
| Ubuntu | cloud-init | pro | 19.4-16-gf8950d63-0ubuntu1 | vulnerable |
| Ubuntu | cloud-init | pro | 19.4-31-g3f6192b3-0ubuntu1 | vulnerable |
| Ubuntu | cloud-init | pro | 19.4-33-gbb4131a2-0ubuntu1 | vulnerable |
| Ubuntu | cloud-init | pro | 19.4-56-g06e324ff-0ubuntu1 | vulnerable |
| Ubuntu | cloud-init | pro | 20.1-0ubuntu1 | vulnerable |
| Ubuntu | cloud-init | pro | 20.1-5-g67c8e53c-0ubuntu1 | vulnerable |
| Ubuntu | cloud-init | pro | 20.1-9-g1f860e5a-0ubuntu1 | vulnerable |
| Ubuntu | cloud-init | pro | 20.1-10-g71af48df-0ubuntu1 | vulnerable |
| Ubuntu | cloud-init | pro | 20.1-10-g71af48df-0ubuntu2 | vulnerable |
| Ubuntu | cloud-init | pro | 20.1-10-g71af48df-0ubuntu3 | vulnerable |
| Ubuntu | cloud-init | pro | 20.1-10-g71af48df-0ubuntu5 | vulnerable |
| Ubuntu | cloud-init | pro | 20.2-45-g5f7825e2-0ubuntu1~20.04.1 | vulnerable |
| Ubuntu | cloud-init | pro | 20.3-2-g371b392c-0ubuntu1~20.04.1 | vulnerable |
| Ubuntu | cloud-init | pro | 20.4-0ubuntu1~20.04.1 | vulnerable |
| Ubuntu | cloud-init | pro | 20.4-0ubuntu1~20.04.2 | vulnerable |
| Ubuntu | cloud-init | pro | 20.4.1-0ubuntu1~20.04.1 | vulnerable |
| Ubuntu | cloud-init | pro | 21.1-19-gbad84ad4-0ubuntu1~20.04.1 | vulnerable |
| Ubuntu | cloud-init | pro | 21.1-19-gbad84ad4-0ubuntu1~20.04.2 | vulnerable |
| Ubuntu | cloud-init | pro | 21.2-3-g899bfaa9-0ubuntu2~20.04.1 | vulnerable |
| Ubuntu | cloud-init | pro | 21.3-1-g6803368d-0ubuntu1~20.04.3 | vulnerable |
| Ubuntu | cloud-init | pro | 21.3-1-g6803368d-0ubuntu1~20.04.4 | vulnerable |
| Ubuntu | cloud-init | pro | 21.4-0ubuntu1~20.04.1 | vulnerable |
| Ubuntu | cloud-init | pro | 22.1-14-g2e17a0d6-0ubuntu1~20.04.2 | vulnerable |
| Ubuntu | cloud-init | pro | 22.1-14-g2e17a0d6-0ubuntu1~20.04.3 | vulnerable |
| Ubuntu | cloud-init | pro | 22.2-0ubuntu1~20.04.1 | vulnerable |
| Ubuntu | cloud-init | pro | 22.2-0ubuntu1~20.04.2 | vulnerable |
| Ubuntu | cloud-init | pro | 22.2-0ubuntu1~20.04.3 | vulnerable |
| Ubuntu | cloud-init | pro | 22.3.4-0ubuntu1~20.04.1 | vulnerable |
| Ubuntu | cloud-init | pro | 22.4.2-0ubuntu0~20.04.1 | vulnerable |
| Ubuntu | cloud-init | pro | 22.4.2-0ubuntu0~20.04.2 | vulnerable |
| Ubuntu | cloud-init | pro | 23.1.1-0ubuntu0~20.04.1 | vulnerable |
| Ubuntu | cloud-init | pro | 23.1.2-0ubuntu0~20.04.1 | vulnerable |
| Ubuntu | cloud-init | pro | 23.1.2-0ubuntu0~20.04.2 | vulnerable |
| Ubuntu | cloud-init | pro | 23.2.1-0ubuntu0~20.04.2 | vulnerable |
| Ubuntu | cloud-init | pro | 23.2.2-0ubuntu0~20.04.1 | vulnerable |
| Ubuntu | cloud-init | pro | 23.3.1-0ubuntu1~20.04.1 | vulnerable |
| Ubuntu | cloud-init | pro | 23.3.3-0ubuntu0~20.04.1 | vulnerable |
| Ubuntu | cloud-init | pro | 23.4.3-0ubuntu0~20.04.1 | vulnerable |
| Ubuntu | cloud-init | pro | 23.4.4-0ubuntu0~20.04.1 | vulnerable |
| Ubuntu | cloud-init | pro | 24.1.3-0ubuntu1~20.04.1 | vulnerable |
| Ubuntu | cloud-init | pro | 24.1.3-0ubuntu1~20.04.4 | vulnerable |
| Ubuntu | cloud-init | pro | 24.1.3-0ubuntu1~20.04.5 | vulnerable |
| Ubuntu | cloud-init | pro | 24.2-0ubuntu1~20.04.1 | vulnerable |
| Ubuntu | cloud-init | pro | 24.3.1-0ubuntu0~20.04.1 | vulnerable |
| Ubuntu | cloud-init | pro | 24.4-0ubuntu1~20.04.1 | vulnerable |
| Ubuntu | cloud-init | pro | 24.4.1-0ubuntu0~20.04.1 | vulnerable |
| Ubuntu | cloud-init | pro | 24.4.1-0ubuntu0~20.04.2 | vulnerable |
| Ubuntu | cloud-init | pro | 24.4.1-0ubuntu0~20.04.3 | vulnerable |
| Ubuntu | cloud-init | pro | 24.4.1-0ubuntu0~20.04.3+esm1 | fixed |
| Ubuntu | cloud-init | 22.04 | 21.3-1-g6803368d-0ubuntu3 | vulnerable |
| Ubuntu | cloud-init | 22.04 | 21.4-0ubuntu1~22.04.1 | vulnerable |
| Ubuntu | cloud-init | 22.04 | 21.4-25-g039c40f9-0ubuntu1~22.04.1 | vulnerable |
| Ubuntu | cloud-init | 22.04 | 21.4-119-gdeb3ae82-0ubuntu1~22.04.1 | vulnerable |
| Ubuntu | cloud-init | 22.04 | 21.4-119-gdeb3ae82-0ubuntu1~22.04.2 | vulnerable |
| Ubuntu | cloud-init | 22.04 | 22.1-1-gb3d9acdd-0ubuntu1~22.04.1 | vulnerable |
| Ubuntu | cloud-init | 22.04 | 22.1-14-g2e17a0d6-0ubuntu1~22.04.1 | vulnerable |
| Ubuntu | cloud-init | 22.04 | 22.1-14-g2e17a0d6-0ubuntu1~22.04.2 | vulnerable |
| Ubuntu | cloud-init | 22.04 | 22.1-14-g2e17a0d6-0ubuntu1~22.04.3 | vulnerable |
| Ubuntu | cloud-init | 22.04 | 22.1-14-g2e17a0d6-0ubuntu1~22.04.4 | vulnerable |
| Ubuntu | cloud-init | 22.04 | 22.1-14-g2e17a0d6-0ubuntu1~22.04.5 | vulnerable |
| Ubuntu | cloud-init | 22.04 | 22.2-0ubuntu1~22.04.1 | vulnerable |
| Ubuntu | cloud-init | 22.04 | 22.2-0ubuntu1~22.04.2 | vulnerable |
| Ubuntu | cloud-init | 22.04 | 22.2-0ubuntu1~22.04.3 | vulnerable |
| Ubuntu | cloud-init | 22.04 | 22.3.4-0ubuntu1~22.04.1 | vulnerable |
| Ubuntu | cloud-init | 22.04 | 22.4.2-0ubuntu0~22.04.1 | vulnerable |
| Ubuntu | cloud-init | 22.04 | 23.1.1-0ubuntu0~22.04.1 | vulnerable |
| Ubuntu | cloud-init | 22.04 | 23.1.2-0ubuntu0~22.04.1 | vulnerable |
| Ubuntu | cloud-init | 22.04 | 23.2.1-0ubuntu0~22.04.1 | vulnerable |
| Ubuntu | cloud-init | 22.04 | 23.2.2-0ubuntu0~22.04.1 | vulnerable |
| Ubuntu | cloud-init | 22.04 | 23.3.1-0ubuntu1~22.04.1 | vulnerable |
| Ubuntu | cloud-init | 22.04 | 23.3.3-0ubuntu0~22.04.1 | vulnerable |
| Ubuntu | cloud-init | 22.04 | 23.4.3-0ubuntu0~22.04.1 | vulnerable |
| Ubuntu | cloud-init | 22.04 | 23.4.4-0ubuntu0~22.04.1 | vulnerable |
| Ubuntu | cloud-init | 22.04 | 24.1.3-0ubuntu1~22.04.1 | vulnerable |
| Ubuntu | cloud-init | 22.04 | 24.1.3-0ubuntu1~22.04.4 | vulnerable |
| Ubuntu | cloud-init | 22.04 | 24.1.3-0ubuntu1~22.04.5 | vulnerable |
| Ubuntu | cloud-init | 22.04 | 24.2-0ubuntu1~22.04.1 | vulnerable |
| Ubuntu | cloud-init | 22.04 | 24.3.1-0ubuntu0~22.04.1 | vulnerable |
| Ubuntu | cloud-init | 22.04 | 24.4-0ubuntu1~22.04.1 | vulnerable |
| Ubuntu | cloud-init | 22.04 | 24.4.1-0ubuntu0~22.04.1 | vulnerable |
| Ubuntu | cloud-init | 22.04 | 24.4.1-0ubuntu0~22.04.2 | vulnerable |
| Ubuntu | cloud-init | 22.04 | 25.1.2-0ubuntu0~22.04.1 | vulnerable |
| Ubuntu | cloud-init | 22.04 | 25.1.2-0ubuntu0~22.04.2 | vulnerable |
| Ubuntu | cloud-init | 22.04 | 25.1.4-0ubuntu0~22.04.1 | fixed |
| Ubuntu | cloud-init | 24.04 | 23.3.1-0ubuntu2 | vulnerable |
| Ubuntu | cloud-init | 24.04 | 23.4~3g0cb0b80f-0ubuntu1 | vulnerable |
| Ubuntu | cloud-init | 24.04 | 23.4-0ubuntu1 | vulnerable |
| Ubuntu | cloud-init | 24.04 | 24.1~1g1003d438-0ubuntu1 | vulnerable |
| Ubuntu | cloud-init | 24.04 | 24.1~2gb6a1c635-0ubuntu1 | vulnerable |
| Ubuntu | cloud-init | 24.04 | 24.1~3gb729a4c4-0ubuntu1 | vulnerable |
| Ubuntu | cloud-init | 24.04 | 24.1~4gd9677655-0ubuntu1 | vulnerable |
| Ubuntu | cloud-init | 24.04 | 24.1~5g1f6eddd5-0ubuntu1 | vulnerable |
| Ubuntu | cloud-init | 24.04 | 24.1~6ga4140119-0ubuntu1 | vulnerable |
| Ubuntu | cloud-init | 24.04 | 24.1~7g54599148-0ubuntu1 | vulnerable |
| Ubuntu | cloud-init | 24.04 | 24.1-0ubuntu1 | vulnerable |
| Ubuntu | cloud-init | 24.04 | 24.1.1-0ubuntu1 | vulnerable |
| Ubuntu | cloud-init | 24.04 | 24.1.2-0ubuntu1 | vulnerable |
| Ubuntu | cloud-init | 24.04 | 24.1.3-0ubuntu1 | vulnerable |
| Ubuntu | cloud-init | 24.04 | 24.1.3-0ubuntu2 | vulnerable |
| Ubuntu | cloud-init | 24.04 | 24.1.3-0ubuntu3 | vulnerable |
| Ubuntu | cloud-init | 24.04 | 24.1.3-0ubuntu3.2 | vulnerable |
| Ubuntu | cloud-init | 24.04 | 24.1.3-0ubuntu3.3 | vulnerable |
| Ubuntu | cloud-init | 24.04 | 24.2-0ubuntu1~24.04.2 | vulnerable |
| Ubuntu | cloud-init | 24.04 | 24.3.1-0ubuntu0~24.04.1 | vulnerable |
| Ubuntu | cloud-init | 24.04 | 24.3.1-0ubuntu0~24.04.2 | vulnerable |
| Ubuntu | cloud-init | 24.04 | 24.4-0ubuntu1~24.04.2 | vulnerable |
| Ubuntu | cloud-init | 24.04 | 24.4.1-0ubuntu0~24.04.1 | vulnerable |
| Ubuntu | cloud-init | 24.04 | 24.4.1-0ubuntu0~24.04.2 | vulnerable |
| Ubuntu | cloud-init | 24.04 | 24.4.1-0ubuntu0~24.04.3 | vulnerable |
| Ubuntu | cloud-init | 24.04 | 25.1.2-0ubuntu0~24.04.1 | vulnerable |
| Ubuntu | cloud-init | 24.04 | 25.1.4-0ubuntu0~24.04.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | cloud-init | source | sid | 25.1.4-1 | not yet assigned | Not reported | [1108403] |
| Debian | cloud-init | source | forky | 25.1.4-1 | not yet assigned | Not reported | [1108403] |
| Debian | cloud-init | source | trixie | 25.1.4-1 | not yet assigned | Not reported | [1108403] |
| Debian | cloud-init | source | bookworm | 22.4.2-1+deb12u3 | not yet assigned | Not reported | [1108403] |
| Ubuntu | cloud-init | deb | noble | 22.4.2-1+deb12u3 | Not reported | Not reported | Not reported |
| Ubuntu | cloud-init | deb | noble | 25.1.4-0ubuntu0~24.04.1 | Not reported | Not reported | Not reported |
| Ubuntu | cloud-init | deb | pro | 24.4.1-0ubuntu0~20.04.3+esm1 | Not reported | UBUNTU-CVE-2024-6174 | Not reported |
| Ubuntu | cloud-init | deb | 22.04 | 25.1.4-0ubuntu0~22.04.1 | Not reported | UBUNTU-CVE-2024-6174 | Not reported |
| Ubuntu | cloud-init | deb | 24.04 | 25.1.4-0ubuntu0~24.04.1 | Not reported | UBUNTU-CVE-2024-6174 | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [cloud-init]Fixed
Details (2)
22.4.2-1+deb12u4· all · bookwormFixed · Fixed:
22.4.2-1+deb12u3usn · cloud-init · debian · bookworm; usn · cloud-init · debian · 12
22.4.2-1+deb12u4· all · bookwormFixed · Fixed:
22.4.2-1+deb12u3usn · cloud-init · debian · bookworm; usn · cloud-init · debian · 12
[Debian 13 (Trixie)]
- [cloud-init]Fixed
Details (2)
25.1.4-1+deb13u1· all · trixieFixed · Fixed:
25.1.4-1usn · cloud-init · debian · 13
25.1.4-1+deb13u1· all · trixieFixed · Fixed:
25.1.4-1usn · cloud-init · debian · 13
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/rhsa-2025_11324.json]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2024-6174]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2024-6174]
- [https://security-tracker.debian.org/tracker/CVE-2024-6174]
- [https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-6174.json]
- [https://ubuntu.com/security/notices/USN-7677-1]
- [https://wid.cert-bund.de/.well-known/csaf/white/2025/wid-sec-w-2025-1539.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]