CVE-2024-0638
📋 TL;DR
This CVE describes a local privilege escalation vulnerability in Checkmk agent plugins mk_oracle, mk_oracle.ps1, and mk_oracle_crs. Local users can exploit improper privilege handling to gain elevated privileges on systems running vulnerable Checkmk versions. Organizations using Checkmk for Oracle database monitoring are affected.
💻 Affected Systems
- Checkmk
📦 What is this software?
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
⚠️ Risk & Real-World Impact
Worst Case
Local attacker gains root/administrator privileges, leading to complete system compromise, data theft, and lateral movement across the network.
Likely Case
Malicious insider or compromised low-privilege account escalates to administrative privileges to install malware, exfiltrate sensitive data, or disrupt monitoring systems.
If Mitigated
Attack is contained to the local system but still allows privilege escalation within that system.
🎯 Exploit Status
Requires local access to the system. The vulnerability is in privilege handling within the agent plugins.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Checkmk 2.3.0b4, 2.2.0p24, 2.1.0p41
Vendor Advisory: https://checkmk.com/werk/16232
Restart Required: Yes
Instructions:
1. Update Checkmk to patched version. 2. Restart Checkmk services. 3. Update all Checkmk agents to patched versions.
🔧 Temporary Workarounds
Disable Oracle plugins
allTemporarily disable the vulnerable Oracle monitoring plugins if not essential
# Linux: Remove or rename plugin files
mv /usr/lib/check_mk_agent/plugins/mk_oracle /usr/lib/check_mk_agent/plugins/mk_oracle.disabled
mv /usr/lib/check_mk_agent/plugins/mk_oracle_crs /usr/lib/check_mk_agent/plugins/mk_oracle_crs.disabled
# Windows: Remove or rename plugin files
Rename-Item C:\ProgramData\checkmk\agent\plugins\mk_oracle.ps1 mk_oracle.ps1.disabled
Restrict plugin permissions
allSet strict file permissions on Oracle plugin files
# Linux: Restrict to root only
chmod 700 /usr/lib/check_mk_agent/plugins/mk_oracle
chmod 700 /usr/lib/check_mk_agent/plugins/mk_oracle_crs
chown root:root /usr/lib/check_mk_agent/plugins/mk_oracle*
# Windows: Restrict to administrators
icacls "C:\ProgramData\checkmk\agent\plugins\mk_oracle.ps1" /inheritance:r /grant:r "Administrators:F"
🧯 If You Can't Patch
- Implement strict access controls to limit who can access Checkmk agent systems
- Monitor for privilege escalation attempts using security tools and audit logs
🔍 How to Verify
Check if Vulnerable:
Check Checkmk version and verify Oracle plugins exist: # Linux: omd version && ls -la /usr/lib/check_mk_agent/plugins/mk_oracle* # Windows: Get-Content "C:\Program Files (x86)\check_mk\etc\omd\site.conf" | Select-String "VERSION" && Test-Path "C:\ProgramData\checkmk\agent\plugins\mk_oracle.ps1"Check Version:
# Linux: omd version # Windows: Get-Content "C:\Program Files (x86)\check_mk\etc\omd\site.conf" | Select-String "VERSION"Verify Fix Applied:
Verify version is patched and plugins have proper permissions: # Linux: omd version | grep -E '2\.3\.0b4|2\.2\.0p24|2\.1\.0p41' && ls -la /usr/lib/check_mk_agent/plugins/mk_oracle*📡 Detection & Monitoring
Log Indicators:
- Unexpected privilege escalation events
- Checkmk agent process spawning with elevated privileges
- Access to Oracle plugin files by non-privileged users
Network Indicators:
- Unusual Checkmk agent communication patterns
SIEM Query:
source="checkmk.log" AND ("privilege" OR "escalation" OR "mk_oracle")