CVE-2024-1488

HIGH
Published Feb 15, 2024 Modified Jan 30, 2025 CWE-276

Description

A vulnerability was found in Unbound due to incorrect default permissions, allowing any process outside the unbound group to modify the unbound runtime configuration. If a process can connect over localhost to port 8953, it can alter the configuration of unbound.service. This flaw allows an unprivileged attacker to manipulate a running instance, potentially altering forwarders, allowing them to track all queries forwarded by the local resolver, and, in some cases, disrupting resolving altogether.

Is your site exposed to CVE-2024-1488?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

8.0
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

Weakness Type (CWE)

CWE-276 Incorrect Default Permissions

Affected Products

Vendor Product
fedoraproject unbound
redhat codeready_linux_builder
redhat codeready_linux_builder_eus
redhat codeready_linux_builder_eus
redhat codeready_linux_builder_eus_for_power_little_endian
redhat codeready_linux_builder_eus_for_power_little_endian
redhat codeready_linux_builder_for_arm64
redhat codeready_linux_builder_for_arm64
redhat codeready_linux_builder_for_arm64_eus
redhat codeready_linux_builder_for_ibm_z_systems
redhat codeready_linux_builder_for_ibm_z_systems
redhat codeready_linux_builder_for_ibm_z_systems_eus
redhat enterprise_linux
redhat enterprise_linux
redhat enterprise_linux_eus
redhat enterprise_linux_eus
redhat enterprise_linux_eus
redhat enterprise_linux_eus
redhat enterprise_linux_for_arm_64
redhat enterprise_linux_for_arm_64
redhat enterprise_linux_for_arm_64
redhat enterprise_linux_for_arm_64_eus
redhat enterprise_linux_for_arm_64_eus
redhat enterprise_linux_for_arm_64_eus
redhat enterprise_linux_for_ibm_z_systems
redhat enterprise_linux_for_ibm_z_systems
redhat enterprise_linux_for_ibm_z_systems
redhat enterprise_linux_for_ibm_z_systems_eus
redhat enterprise_linux_for_ibm_z_systems_eus
redhat enterprise_linux_for_ibm_z_systems_eus
redhat enterprise_linux_for_power_little_endian
redhat enterprise_linux_for_power_little_endian
redhat enterprise_linux_for_power_little_endian
redhat enterprise_linux_for_power_little_endian_eus
redhat enterprise_linux_for_power_little_endian_eus
redhat enterprise_linux_for_power_little_endian_eus
redhat enterprise_linux_server_aus
redhat enterprise_linux_server_aus
redhat enterprise_linux_server_aus
redhat enterprise_linux_server_aus
redhat enterprise_linux_server_aus
redhat enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions
redhat enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions
redhat enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions
redhat enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions
redhat enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions
redhat enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions
redhat enterprise_linux_server_tus
redhat enterprise_linux_server_tus
redhat enterprise_linux_server_tus
redhat enterprise_linux_server_tus

References

Frequently Asked Questions

What is CVE-2024-1488? +
A vulnerability was found in Unbound due to incorrect default permissions, allowing any process outside the unbound group to modify the unbound runtime configuration. If a process can connect over localhost to port 8953, it can alter the configuration of unbound.service. This flaw allows an unprivileged attacker to manipulate a running instance, potentially altering forwarders, allowing them to track all queries forwarded by the local resolver, and, in some cases, disrupting resolving altogether. It has a CVSS v3.1 base score of 8.0 (HIGH).
How severe is CVE-2024-1488? +
CVE-2024-1488 has a CVSS v3.1 score of 8.0 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching.
What products are affected by CVE-2024-1488? +
CVE-2024-1488 affects products from fedoraproject, redhat, specifically: codeready_linux_builder, codeready_linux_builder_eus, codeready_linux_builder_eus_for_power_little_endian, codeready_linux_builder_for_arm64, codeready_linux_builder_for_arm64_eus, codeready_linux_builder_for_ibm_z_systems, codeready_linux_builder_for_ibm_z_systems_eus, enterprise_linux, enterprise_linux_eus, enterprise_linux_for_arm_64, enterprise_linux_for_arm_64_eus, enterprise_linux_for_ibm_z_systems, enterprise_linux_for_ibm_z_systems_eus, enterprise_linux_for_power_little_endian, enterprise_linux_for_power_little_endian_eus, enterprise_linux_server_aus, enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions, enterprise_linux_server_tus, unbound. Check the affected products table above for specific version ranges.
How do I check if I'm vulnerable to CVE-2024-1488? +
You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-20718

Incorrect default permissions for some Intel(R) NPU Driver software installers before version 32.0.100.4511 within Ring 3: User Applications may allow …
CVE-2026-0539

Incorrect Default Permissions in pcvisit service binary on Windows allows a low-privileged local attacker to escalate their privileges by overwriting …
CVE-2025-2782

The WatchGuard Terminal Services Agent on Windows does not properly configure directory permissions when installed in a non-default directory. This …
CVE-2025-2781

The WatchGuard Mobile VPN with SSL Client on Windows does not properly configure directory permissions when installed in a non-default …
CVE-2025-4280

MacOS version of Poedit bundles a Python interpreter that inherits the Transparency, Consent, and Control (TCC) permissions granted by the …
CVE-2025-4412

On macOS systems, by utilizing a Launch Agent and loading the viscosity_openvpn process from the application bundle, it is possible …

Don't wait for an exploit

Scan your website for vulnerabilities like CVE-2024-1488 — free, no signup required.