CVE-2024-6174: Canonical Cloud-init Auth Bypass Flaw

CVE-2024-6174 Overview

CVE-2024-6174 is an authentication flaw in Canonical cloud-init that grants root access to a hardcoded URL with a local IP address when a non-x86 platform is detected. The issue is categorized under [CWE-287] Improper Authentication. Cloud-init default configurations disable platform enumeration to prevent this behavior, but affected deployments that enable enumeration expose privileged access over the adjacent network. The vulnerability affects canonical:cloud-init and is addressed in the GitHub Cloud-Init Release 25.1.3.

Critical Impact
An attacker on an adjacent network can obtain root-level access to instances initialized by cloud-init on non-x86 platforms when default hardening is not in place.

Affected Products

Canonical cloud-init (prior to 25.1.3)
Linux instances provisioned on non-x86 platforms using cloud-init
Cloud and virtualization images relying on cloud-init platform enumeration

Discovery Timeline

2025-06-26 - CVE-2024-6174 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-6174

Vulnerability Analysis

Cloud-init automates the initialization of cloud instances during first boot. It supports multiple datasources that describe how the instance retrieves user data and metadata. When cloud-init detects a non-x86 platform through platform enumeration, it queries a hardcoded URL that points to a local IP address. The code path granted root-equivalent trust to the response from that endpoint without adequate authentication of the source.

An attacker who can respond on that adjacent network path can serve crafted metadata or user data that cloud-init executes with root privileges during boot. The result is full instance compromise before workloads and security controls are fully initialized. The flaw is tracked under [CWE-287] Improper Authentication.

Root Cause

The root cause is trust placed in a hardcoded local URL without authenticating the responding service. Platform enumeration triggers this code path on non-x86 architectures. Cloud-init default configurations mitigate the exposure by disabling platform enumeration, but deployments that enable it inherit the trust decision.

Attack Vector

The attack requires adjacent-network access to the local address that cloud-init contacts during boot. An attacker positioned on the same layer-2 segment or virtual network can impersonate the expected metadata endpoint. No user interaction and no prior privileges are required. Successful exploitation yields high-impact loss of confidentiality, integrity, and availability on the target instance.

No verified proof-of-concept code has been published. Refer to the GitHub Cloud-Init Release 25.1.3 notes for technical remediation details.

Detection Methods for CVE-2024-6174

Indicators of Compromise

Unexpected outbound requests from cloud-init during boot to hardcoded local IP addresses on non-x86 hosts
Unauthorized root-owned scripts, services, or SSH keys installed during first-boot initialization
Cloud-init log entries (/var/log/cloud-init.log, /var/log/cloud-init-output.log) referencing platform enumeration on non-x86 systems

Detection Strategies

Audit installed cloud-init versions across your fleet and flag any version prior to 25.1.3
Review cloud-init configuration for enabled platform enumeration on ARM, POWER, or s390x systems
Correlate first-boot network traffic with expected metadata service endpoints for each platform

Monitoring Recommendations

Alert on cloud-init contacting link-local or hardcoded IP addresses outside the sanctioned metadata service
Monitor for new privileged accounts, SSH keys, or systemd units created during instance initialization
Centralize cloud-init boot logs into a SIEM or data lake for retention and cross-fleet analysis

How to Mitigate CVE-2024-6174

Immediate Actions Required

Upgrade cloud-init to version 25.1.3 or later on all affected images and running instances
Rebuild and redeploy golden images used to provision non-x86 workloads
Verify that platform enumeration remains disabled in cloud-init default configurations

Patch Information

Canonical addressed the issue in cloud-init25.1.3. Package details and changelog are available in the GitHub Cloud-Init Release 25.1.3. Apply distribution-provided updates through your package manager once vendors publish backported fixes.

Workarounds

Keep the cloud-init default configuration that disables platform enumeration in place
Restrict adjacent-network access to instance metadata endpoints using network segmentation and hypervisor policies
Pin cloud-init datasources explicitly to the trusted provider for your environment instead of relying on enumeration

bash

# Verify installed cloud-init version
cloud-init --version

# Explicitly pin the datasource and disable enumeration in
# /etc/cloud/cloud.cfg.d/99-disable-enumeration.cfg
datasource_list: [ NoCloud, ConfigDrive, None ]