CVE-2024-52976
Elastic Agent Inclusion of Functionality from Untrusted Control Sphere
概要
Elastic Agent Inclusion of Functionality from Untrusted Control Sphere
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Inclusion of functionality from an untrusted control sphere in Elastic Agent subprocess, osqueryd, allows local attackers to execute arbitrary code via parameter injection.
An attacker requires local access and the ability to modify osqueryd configurations.
参照URL
- advisory github.com
- advisory nvd.nist.gov
- web discuss.elastic.co