CVE-2024-42381: Homebrew brew RCE Vulnerability

CVE-2024-42381 Overview

CVE-2024-42381 is a code execution vulnerability in Homebrew brew versions prior to 4.2.20. The flaw resides in os/linux/elf.rb, which uses ldd to load Executable and Linkable Format (ELF) files obtained from untrusted sources. Attackers can craft a malicious ELF file with a custom .interp section to trigger arbitrary code execution. The execution occurs during an un-sandboxed binary relocation phase, before the user expects any downloaded package content to run. The vulnerability was identified during a Trail of Bits security audit of Homebrew. The tested vulnerable revision was commit 237d1e783f7ee261beaba7d3f6bde22da7148b0a.

Critical Impact
A crafted bottle or formula can achieve code execution on Linux hosts running Homebrew before user-visible install steps, breaking the trust boundary between downloading and executing package content.

Affected Products

Homebrew brew versions before 4.2.20 on Linux
Homebrew commit 237d1e783f7ee261beaba7d3f6bde22da7148b0a (verified vulnerable)
Library/Homebrew/os/linux/elf.rb component

Discovery Timeline

2024-07-30 - Trail of Bits publishes Homebrew security audit findings
2024-07-30 - Homebrew publishes security audit announcement and releases version 4.2.20
2024-07-31 - CVE-2024-42381 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2024-42381

Vulnerability Analysis

The vulnerability is categorized under [CWE-830] (Inclusion of Web Functionality from an Untrusted Source). Homebrew's Linux ELF handling logic in os/linux/elf.rb invoked ldd to enumerate dynamic dependencies of downloaded binaries. The ldd utility resolves shared libraries by executing the ELF's program interpreter specified in its .interp ELF section. When brew runs ldd against an untrusted ELF file, the operating system honors the embedded interpreter path. An attacker who controls the .interp field can therefore point it at an arbitrary executable, which the loader then runs with the privileges of the brew process. This occurs during binary relocation, which Homebrew performs automatically after fetching a bottle but before invoking package install hooks.

Root Cause

The root cause is the use of ldd as a parsing tool for untrusted ELF binaries. ldd is not a safe parser; on Linux it loads and partially executes the target through the interpreter named in its .interp section. Homebrew assumed ldd would behave as a read-only inspection command, which is an unsafe assumption for files sourced from networked repositories.

Attack Vector

An attacker delivers a malicious bottle, tap, or formula containing an ELF file whose .interp header references an attacker-controlled binary embedded in the same package. When brew downloads the bottle and invokes ELF inspection during relocation, the loader executes the custom interpreter. Exploitation requires the user to install or upgrade a poisoned package, satisfying the user-interaction requirement noted in the CVSS vector.

ruby

# Patch excerpt from Library/Homebrew/os/linux/elf.rb
# typed: true
# frozen_string_literal: true

require "os/linux/ld"

# {Pathname} extension for dealing with ELF files.
# @see https://en.wikipedia.org/wiki/Executable_and_Linkable_Format#File_header

Source: Homebrew commit 916b373

ruby

# New helper module Library/Homebrew/os/linux/ld.rb replaces ldd
# typed: strict
# frozen_string_literal: true

module OS
  module Linux
    # Helper functions for querying `ld` information.
    #
    # @api private
    module Ld
      sig { returns(String) }
      def self.brewed_ld_so_diagnostics
        brewed_ld_so = HOMEBREW_PREFIX/"lib/ld.so"
        return "" unless brewed_ld_so.exist?

        ld_so_output = Utils.popen_read(brewed_ld_so, "--list-diagnostics")
        return "" unless $CHILD_STATUS.success?

        ld_so_output
      end

      sig { returns(String) }
      def self.sysconfdir
        fallback_sysconfdir = "/etc"

        match = brewed_ld_so_diagnostics.match(/path.sysconfdir="(.+)"/)
        return fallback_sysconfdir unless match

        match.captures.compact.first || fallback_sysconfdir
      end

Source: Homebrew commit 916b373. The patch replaces ldd invocation with a safe ld.so --list-diagnostics query, avoiding execution of the target ELF's interpreter.

Detection Methods for CVE-2024-42381

Indicators of Compromise

Unexpected child processes spawned by brew during install, upgrade, or reinstall operations on Linux hosts
Execution of binaries from paths inside Homebrew's Cellar or download cache where the binary is not the documented package entry point
ELF files within downloaded bottles whose .interp section references a path outside the standard dynamic linker locations such as /lib64/ld-linux-x86-64.so.2
Network connections initiated by brew subprocesses to hosts not associated with Homebrew or its bottle mirrors

Detection Strategies

Audit Homebrew installations for versions older than 4.2.20 using brew --version
Inspect cached bottles with readelf -l <file> | grep interpreter and flag any non-standard interpreter paths
Monitor process trees for brew parents spawning unexpected ELF executables prior to formula post-install scripts
Correlate package install events with file integrity changes outside the expected Cellar paths for that formula

Monitoring Recommendations

Enable shell and process auditing on developer and CI Linux hosts that run Homebrew
Forward execve telemetry from brew-initiated process trees into a centralized analytics platform for retroactive hunting
Alert on bottle downloads from third-party taps that have not been previously whitelisted by your organization

How to Mitigate CVE-2024-42381

Immediate Actions Required

Upgrade Homebrew to version 4.2.20 or later by running brew update followed by brew --version to confirm the installed release
Audit all third-party taps with brew tap and remove any that are not strictly required
Re-validate or reinstall recently installed Linux bottles fetched while running a vulnerable brew release
Restrict Homebrew usage in shared CI runners until hosts are confirmed patched

Patch Information

The fix is included in Homebrew release 4.2.20 via pull request 17136 and commit 916b3738. The patch removes the ldd invocation in os/linux/elf.rb and introduces the OS::Linux::Ld helper module, which parses dynamic linker output via ld.so --list-diagnostics rather than executing the target binary's interpreter.

Workarounds

Install only bottles from the official homebrew/core tap until upgraded to 4.2.20
Run brew operations under an unprivileged user account confined by a sandboxing layer such as bwrap or a container
Manually inspect downloaded ELF files with readelf -p .interp before allowing relocation to proceed on systems that cannot be upgraded

bash

# Upgrade and verify Homebrew on Linux
brew update
brew upgrade
brew --version  # confirm >= 4.2.20

# Inspect cached bottles for suspicious interpreters
find "$(brew --cache)" -type f -name '*.bottle.*' -exec sh -c '
  for f; do
    tar -tf "$f" 2>/dev/null | while read entry; do
      tar -xOf "$f" "$entry" 2>/dev/null | \
        readelf -p .interp - 2>/dev/null | grep -v "ld-linux\|ld-musl"
    done
  done
' sh {} +