CVE-2024-29864
📋 TL;DR
CVE-2024-29864 is a command injection vulnerability in Distrobox that allows attackers to execute arbitrary code by injecting malicious commands into exported executables. This affects all users running Distrobox versions before 1.7.0.1. The vulnerability stems from improper input sanitization when handling exported executable files.
💻 Affected Systems
- Distrobox
📦 What is this software?
Distrobox by 89luca89
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with root privileges, allowing attackers to install malware, exfiltrate data, or pivot to other systems.
Likely Case
Local privilege escalation leading to container escape and host system compromise, potentially affecting all containers managed by Distrobox.
If Mitigated
Limited impact to isolated containers with proper security boundaries and minimal privileges.
🎯 Exploit Status
Exploitation requires local access to the system. Proof of concept available in GitHub issues.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.7.0.1
Vendor Advisory: https://github.com/89luca89/distrobox/commit/82a69f0a234e73e447d0ea8c8b3443b84fd31944
Restart Required: No
Instructions:
1. Update Distrobox using your package manager or from source. 2. For package managers: 'sudo apt update && sudo apt upgrade distrobox' (adjust for your distro). 3. For source: 'git clone https://github.com/89luca89/distrobox && cd distrobox && sudo make install'.
🔧 Temporary Workarounds
Disable exported executables
linuxTemporarily disable the exported executables feature that contains the vulnerability
export DISTROBOX_DISABLE_EXPORT=1
Remove vulnerable executables
linuxRemove any exported executables created by Distrobox
rm -f ~/.local/bin/distrobox-*
rm -f /usr/local/bin/distrobox-*
🧯 If You Can't Patch
- Implement strict access controls to limit who can run Distrobox commands
- Use container isolation with minimal privileges and read-only filesystems where possible
🔍 How to Verify
Check if Vulnerable:
Check Distrobox version: 'distrobox --version'. If version is below 1.7.0.1, you are vulnerable.Check Version:
distrobox --versionVerify Fix Applied:
After updating, verify version is 1.7.0.1 or higher: 'distrobox --version'📡 Detection & Monitoring
Log Indicators:
- Unusual command execution patterns from Distrobox processes
- Suspicious shell commands in container logs
Network Indicators:
- Unexpected outbound connections from containers
- Unusual process spawning patterns
SIEM Query:
process.name:distrobox AND (process.cmdline:*;* OR process.cmdline:*&* OR process.cmdline:*|*)