Ansible-core: user module generate_ssh_key follows a symlinked ~/.ssh enabling local privilege escalation (incomplete fix of cve-2024-9902)
- Exploited
- No known exploitation
- Fix
- No fix listed
- Who is exposed
- Not reported
- Last modified
- FIRST's estimate of the chance attackers exploit it in the next 30 days, updated daily.What do these mean? →
- 0.11% · 1st percentile
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 23/100 · provisional
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
The ansible-core user module, when its generate_ssh_key option is enabled, can be abused locally by a user with a low-privilege account on a managed node to gain root access. The attacker replaces their ~/.ssh directory with a symlink so the privileged module writes key files to a root-writable location, then uses that write to plant files that root later runs.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
Read the original description
A flaw was found in the ansible-core user module. When generate_ssh_key is enabled, User.ssh_key_gen() guards the key files against symlinks but checks the ~/.ssh directory only with os.path.exists(). An unprivileged user on a managed node who replaces their ~/.ssh with a symlink to an existing root-writable directory causes the privileged module to write the generated key pair through the symlink and then chown both files to that user. Because such files can be dropped into directories processed by schedulers (e.g. /etc/cron.daily) or dynamic MOTD (/etc/update-motd.d), the user can escalate to root on the managed node. This is an incomplete fix of CVE-2024-9902.
cve.now Index
- Exploitation0/40No signal
- Exposure?/25Unknown. No advisory context yet
- Reach10/20Shipped in major Linux distributions
- Severity7.7/10CVSS 6.7, total technical impact per CISA
- No patch5/5No patch listed yet
What would change the score
- Would score about 78 if added to CISA KEV
- Would score about 73 if CISA's SSVC rates exploitation active
- Would score about 45 if advisories confirm default setups are exposed
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- mta/mta-rhel9-operator
Version range not reported
- migration-toolkit-virtualization/mtv-rhel9-operator
Version range not reported
- mtv-candidate/mtv-rhel9-operator
Version range not reported
- openshift-service-mesh/kiali-rhel9-operator
Version range not reported
- rhacm2/volsync-operator-bundle
Version range not reported
- rhacm2/volsync-rhel9
Version range not reported
- ansible-automation-platform-24/hub-rhel8
Version range not reported
- ansible-automation-platform-24/lightspeed-rhel8
Version range not reported
Show all 71 packagesShow fewer packages
- ansible-automation-platform-25/controller-rhel8-operator
Version range not reported
- ansible-automation-platform-25/de-minimal-rhel8
Version range not reported
- ansible-automation-platform-25/de-supported-rhel8
Version range not reported
- ansible-automation-platform-25/eda-controller-rhel8
Version range not reported
- ansible-automation-platform-25/eda-controller-rhel8-operator
Version range not reported
- ansible-automation-platform-25/ee-minimal-rhel8
Version range not reported
- ansible-automation-platform-25/ee-minimal-rhel9
Version range not reported
- ansible-automation-platform-25/ee-supported-rhel8
Version range not reported
- ansible-automation-platform-25/ee-supported-rhel9
Version range not reported
- ansible-automation-platform-25/gateway-rhel8-operator
Version range not reported
- ansible-automation-platform-25/hub-rhel8
Version range not reported
- ansible-automation-platform-25/hub-rhel8-operator
Version range not reported
- ansible-automation-platform-25/lightspeed-rhel8
Version range not reported
- ansible-automation-platform-25/lightspeed-rhel8-operator
Version range not reported
- ansible-automation-platform-25/platform-resource-rhel8-operator
Version range not reported
- ansible-automation-platform-25/platform-resource-runner-rhel8
Version range not reported
- ansible-automation-platform-26/controller-rhel9-operator
Version range not reported
- ansible-automation-platform-26/de-minimal-rhel9
Version range not reported
- ansible-automation-platform-26/de-supported-rhel9
Version range not reported
- ansible-automation-platform-26/eda-controller-rhel9
Version range not reported
- ansible-automation-platform-26/eda-controller-rhel9-operator
Version range not reported
- ansible-automation-platform-26/ee-minimal-rhel9
Version range not reported
- ansible-automation-platform-26/ee-supported-rhel9
Version range not reported
- ansible-automation-platform-26/gateway-rhel9-operator
Version range not reported
- ansible-automation-platform-26/hub-rhel9
Version range not reported
- ansible-automation-platform-26/hub-rhel9-operator
Version range not reported
- ansible-automation-platform-26/lightspeed-rhel9
Version range not reported
- ansible-automation-platform-26/lightspeed-rhel9-operator
Version range not reported
- ansible-automation-platform-26/platform-resource-rhel9-operator
Version range not reported
- ansible-automation-platform-26/platform-resource-runner-rhel9
Version range not reported
- ansible-automation-platform-27/aap-cloud-billing-operator-rhel9
Version range not reported
- ansible-automation-platform-27/controller-rhel9-operator
Version range not reported
- ansible-automation-platform-27/de-minimal-rhel9
Version range not reported
- ansible-automation-platform-27/de-supported-rhel9
Version range not reported
- ansible-automation-platform-27/eda-controller-rhel9
Version range not reported
- ansible-automation-platform-27/eda-controller-rhel9-operator
Version range not reported
- ansible-automation-platform-27/ee-minimal-rhel9
Version range not reported
- ansible-automation-platform-27/ee-supported-rhel9
Version range not reported
- ansible-automation-platform-27/gateway-rhel9-operator
Version range not reported
- ansible-automation-platform-27/hub-rhel9
Version range not reported
- ansible-automation-platform-27/hub-rhel9-operator
Version range not reported
- ansible-automation-platform-27/lightspeed-rhel9
Version range not reported
- ansible-automation-platform-27/lightspeed-rhel9-operator
Version range not reported
- ansible-automation-platform-27/metrics-service-rhel9-operator
Version range not reported
- ansible-automation-platform-27/platform-resource-rhel9-operator
Version range not reported
- ansible-automation-platform-27/platform-resource-runner-rhel9
Version range not reported
- ansible-automation-platform-tech-preview/ansible-devspaces-rhel9
Version range not reported
- ansible-automation-platform-tech-preview/metrics-service-rhel9-operator
Version range not reported
- ansible-core
Version range not reported
- ansible-automation-platform/ee-minimal-rhel8
Version range not reported
- ansible-automation-platform/ee-minimal-rhel9
Version range not reported
- ansible-automation-platform-tech-preview/ee-minimal-rhel8
Version range not reported
- ansible-automation-platform-tech-preview/ee-minimal-rhel9
Version range not reported
- discovery/discovery-server-rhel9
Version range not reported
- ansible-core
Version range not reported
- ansible-core
Version range not reported
- ansible-core
Version range not reported
- openshift4/ose-ansible-rhel9-operator
Version range not reported
- openshift5/ose-ansible-rhel9-operator
Version range not reported
- ansible-core
Version range not reported
- ansible-automation-platform/bootc-automation-portal-rhel9
Version range not reported
- stf/service-telemetry-rhel9-operator
Version range not reported
- stf/smart-gateway-rhel9-operator
Version range not reported
Evidence 2
- Report
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.