CVE-2024-32019: Netdata Agent Privilege Escalation Flaw

CVE-2024-32019 Overview

CVE-2024-32019 is a local privilege escalation vulnerability in the Netdata Agent, an open source observability tool. The flaw resides in the ndsudo helper, a SUID root executable shipped with affected versions. ndsudo invokes a restricted set of external commands but resolves their locations using the untrusted PATH environment variable. A local attacker who controls PATH can point ndsudo at an attacker-written binary, which then executes with root privileges. The issue is tracked as an untrusted search path weakness [CWE-426]. Netdata addressed the vulnerability in versions 1.45.3 and 1.45.2-169.

Critical Impact
Local users on hosts running vulnerable Netdata Agent builds can escalate to root by manipulating PATH and staging a malicious binary that ndsudo executes.

Affected Products

Netdata Agent versions prior to 1.45.3
Netdata Agent nightly builds prior to 1.45.2-169
Installations where the ndsudo SUID helper is present

Discovery Timeline

2024-04-12 - CVE-2024-32019 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-32019

Vulnerability Analysis

The Netdata Agent ships ndsudo, a helper installed as a root-owned executable with the SUID bit set. Its purpose is to run a small allow-list of external programs required by Netdata data collectors. ndsudo locates those programs by name rather than absolute path, delegating resolution to the process PATH environment variable. Because SUID binaries retain effective UID 0 when executed by unprivileged users, any command ndsudo spawns inherits root privileges. An attacker who prepends a writable directory to PATH before calling ndsudo can supply a malicious binary matching one of the expected command names, achieving arbitrary code execution as root. The EPSS score for this CVE is 1.165% (63.489 percentile).

Root Cause

The root cause is an untrusted search path [CWE-426]. ndsudo invokes helper commands without hardcoding their absolute paths and without sanitizing environment variables inherited from the calling user. A SUID binary must never trust PATH, LD_LIBRARY_PATH, or similar variables under attacker control.

Attack Vector

Exploitation requires local access with permission to execute ndsudo. The attacker creates a directory containing a malicious executable named after one of ndsudo's permitted commands, exports PATH so the malicious directory is searched first, and then runs ndsudo. ndsudo resolves the command via PATH, executes the attacker binary, and grants root code execution. Attack complexity is low and no user interaction is required.

No verified public proof-of-concept code is referenced in the advisory. Technical details are available in the Netdata GitHub Security Advisory and the remediation pull request.

Detection Methods for CVE-2024-32019

Indicators of Compromise

Unexpected executables in user-writable directories that share names with commands invoked by ndsudo (for example package managers or system utilities).
Process audit records showing ndsudo spawning child processes from non-standard paths such as /tmp, /dev/shm, or user home directories.
New root-owned processes or persistence artifacts created by a session that previously ran ndsudo.

Detection Strategies

Enable Linux auditd rules on execve for the ndsudo binary and alert when the resolved child executable is outside /usr, /bin, or /sbin.
Monitor for setuid or setgid file creation and unexpected privilege transitions immediately following ndsudo execution.
Inventory hosts for the presence of ndsudo and correlate its version against the fixed releases 1.45.3 and 1.45.2-169.

Monitoring Recommendations

Ship shell history, process execution, and file integrity telemetry to a central data lake for retrospective hunting on PATH manipulation patterns.
Alert on environment variable changes in shells that assign writable directories to the front of PATH before invoking SUID binaries.
Track Netdata Agent package versions across the fleet and flag any host still running a vulnerable build.

How to Mitigate CVE-2024-32019

Immediate Actions Required

Upgrade the Netdata Agent to 1.45.3 (stable) or 1.45.2-169 (nightly) or later on every host.
Until patching is complete, remove the SUID bit from ndsudo or restrict execute permission to a trusted group.
Audit local accounts on Netdata hosts and remove interactive access for users that do not require it.

Patch Information

Netdata released fixes in stable version 1.45.3 and nightly build 1.45.2-169. The remediation replaces PATH-based command lookup with hardened resolution logic. Refer to the Netdata pull request 17377 and the GHSA-pmhq-4cxq-wj93 advisory for the full change set.

Workarounds

The vendor advisory states there are no known workarounds; patching is required.
As a temporary hardening measure, administrators can chmod u-s /usr/libexec/netdata/plugins.d/ndsudo to disable the SUID bit, accepting that affected collectors will lose functionality until the host is upgraded.

bash

# Configuration example - temporary hardening until patch is applied
sudo find / -name ndsudo -perm -4000 2>/dev/null
sudo chmod u-s $(which ndsudo)

# After upgrade, verify installed version
netdata -v
# Expected: v1.45.3 or later