Skip to content
Fencer Vulns
medium 4.4

CVE-2024-35235 json

Cupsd Listen arbitrary chmod 0140777

published 2024-06-11 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-35252

cvss
4.4
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
2.4%
EPSS 2.4% chance of exploitation in 30 days, percentile 84%
public exploits
0
none known

Summary

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.8 and earlier, when starting the cupsd server with a Listen configuration item pointing to a symbolic link, the cupsd process can be caused to perform an arbitrary chmod of the provided argument, providing world-writable access to the target. Given that cupsd is often running as root, this can result in the change of permission of any user or system files to be world writable. Given the aforementioned Ubuntu AppArmor context, on such systems this vulnerability is limited to those files modifiable by the cupsd process. In that specific case it was found to be possible to turn the configuration of the Listen argument into full control over the cupsd.conf and cups-files.conf configuration files. By later setting the User and Group arguments in cups-files.conf, and printing with a printer configured by PPD with a `FoomaticRIPCommandLine` argument, arbitrary user and group (not root) command execution could be achieved, which can further be used on Ubuntu systems to achieve full root command execution. Commit ff1f8a623e090dee8a8aadf12a6a4b25efac143d contains a patch for the issue.

Patch / fix

  • cups cups 2.4.9
  • openprinting cups 2.4.9
  • cups Debian 12 2.4.2-3+deb12u6
  • cups Debian 14, Debian 13 2.4.7-2

debian advisories DEBIAN-CVE-2024-35235

  • cups Ubuntu 20.04 LTS 2.3.1-9ubuntu1.7
  • cups Ubuntu 22.04 LTS 2.4.1op1-1ubuntu4.9
  • cups Ubuntu 24.04 LTS 2.4.7-1.2ubuntu7.1
  • cups Ubuntu Pro 16.04 LTS 2.1.3-4ubuntu0.11+esm6
  • cups Ubuntu Pro 18.04 LTS 2.2.7-1ubuntu2.10+esm4

ubuntu advisories UBUNTU-CVE-2024-35235

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • cups RHEL 9 1:2.3.3op2-27.el9_4
  • cups-lpd RHEL 9 1:2.3.3op2-27.el9_4
  • cups-libs RHEL 9 1:2.3.3op2-27.el9_4
  • cups-client RHEL 9 1:2.3.3op2-27.el9_4
  • cups-ipptool RHEL 9 1:2.3.3op2-27.el9_4
  • cups-filesystem RHEL 9 1:2.3.3op2-27.el9_4
  • cups-printerapp RHEL 9 1:2.3.3op2-27.el9_4
  • cups RHEL 8 1:2.2.6-60.el8_10

red hat advisories RHSA-2024:5644RHSA-2024:4715RHSA-2024:4776RHSA-2024:4580RHSA-2024:4265

  • cups Linux Micro 6.0 2.4.11-1.1
  • cups SLE Module for Development Tools 15 SP6, SLE Module for Development Tools 15 SP5, SLE Module for Desktop Applications 15 SP6 +24 more 2.2.7-150000.3.59.1
  • cups SLES for SAP 12 SP5, SLES 12 SP5, SLE Software Development Kit 12 SP5 1.7.5-20.49.1

suse advisories SUSE-SU-2025:20090-1SUSE-SU-2024:2003-1SUSE-SU-2024:2003-2SUSE-SU-2024:2002-1

  • cups openSUSE Tumbleweed 2.4.8-1.1

opensuse advisories openSUSE-SU-2024:14041-1

  • cups AlmaLinux 9 1:2.3.3op2-27.el9_4
  • cups-lpd AlmaLinux 9 1:2.3.3op2-27.el9_4
  • cups-libs AlmaLinux 9 1:2.3.3op2-27.el9_4
  • cups-client AlmaLinux 9 1:2.3.3op2-27.el9_4
  • cups-ipptool AlmaLinux 9 1:2.3.3op2-27.el9_4
  • cups-filesystem AlmaLinux 9 1:2.3.3op2-27.el9_4
  • cups-printerapp AlmaLinux 9 1:2.3.3op2-27.el9_4
  • cups AlmaLinux 8 1:2.2.6-60.el8_10

almalinux advisories ALSA-2024:4776ALSA-2024:4265

  • cups Rocky Linux 8 1:2.2.6-60.el8_10

rocky linux advisories RLSA-2024:4265

  • cups Alpine 3.24, Alpine 3.23, Alpine 3.22 +5 more 2.4.9-r0

alpine advisories ALPINE-CVE-2024-35235

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • cups Azure Linux 3.0 2.4.10-1
  • cups CBL-Mariner 2.0 2.3.3op2-9

azure linux advisories AZL-42579AZL-42592

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-35235 updated cvss 4.4

cups: Cupsd Listen arbitrary chmod 0140777

  • Red Hat Enterprise Linux 6 cups, cups-lpd, cups-php, cups-libs Red Hat Enterprise Linux 7 cups, cups-lpd, cups-libs, cups-client, cups-ipptool, cups-filesystem
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Enterprise Linux AppStream (v. 8) cups 2.2.6-60.el8_10, cups-lpd 2.2.6-60.el8_10, cups-client 2.2.6-60.el8_10, cups-ipptool 2.2.6-60.el8_10, cups-filesystem 2.2.6-60.el8_10
    fixed: vendor fix RHSA-2024:4265
  • Red Hat Enterprise Linux AppStream (v. 9) cups 2.3.3op2-27.el9_4, cups-lpd 2.3.3op2-27.el9_4, cups-client 2.3.3op2-27.el9_4, cups-ipptool 2.3.3op2-27.el9_4, cups-filesystem 2.3.3op2-27.el9_4, cups-printerapp 2.3.3op2-27.el9_4
    fixed: vendor fix RHSA-2024:4776
  • Red Hat Enterprise Linux AppStream AUS (v.8.6) cups 2.2.6-45.el8_6.5, cups-lpd 2.2.6-45.el8_6.5, cups-client 2.2.6-45.el8_6.5, cups-ipptool 2.2.6-45.el8_6.5, cups-filesystem 2.2.6-45.el8_6.5 Red Hat Enterprise Linux AppStream E4S (v.8.6) cups 2.2.6-45.el8_6.5, cups-lpd 2.2.6-45.el8_6.5, cups-client 2.2.6-45.el8_6.5, cups-ipptool 2.2.6-45.el8_6.5, cups-filesystem 2.2.6-45.el8_6.5
    fixed: vendor fix RHSA-2024:4715
  • Red Hat Enterprise Linux AppStream EUS (v.8.8) cups 2.2.6-51.el8_8.4, cups-lpd 2.2.6-51.el8_8.4, cups-client 2.2.6-51.el8_8.4, cups-ipptool 2.2.6-51.el8_8.4, cups-filesystem 2.2.6-51.el8_8.4
    fixed: vendor fix RHSA-2024:4580
  • Red Hat Enterprise Linux AppStream EUS (v.9.2) cups 2.3.3op2-16.el9_2.2, cups-lpd 2.3.3op2-16.el9_2.2, cups-client 2.3.3op2-16.el9_2.2, cups-ipptool 2.3.3op2-16.el9_2.2, cups-filesystem 2.3.3op2-16.el9_2.2, cups-printerapp 2.3.3op2-16.el9_2.2
    fixed: vendor fix RHSA-2024:5644
  • Red Hat Enterprise Linux AppStream TUS (v.8.6) cups 2.2.6-45.el8_6.5, cups-lpd 2.2.6-45.el8_6.5, cups-client 2.2.6-45.el8_6.5, cups-ipptool 2.2.6-45.el8_6.5, cups-filesystem 2.2.6-45.el8_6.5
    fixed: vendor fix RHSA-2024:4715
  • Red Hat Enterprise Linux BaseOS (v. 8) cups 2.2.6-60.el8_10, cups-libs 2.2.6-60.el8_10
    fixed: vendor fix RHSA-2024:4265
show 6 more
  • Red Hat Enterprise Linux BaseOS (v. 9) cups 2.3.3op2-27.el9_4, cups-libs 2.3.3op2-27.el9_4
    fixed: vendor fix RHSA-2024:4776
  • Red Hat Enterprise Linux BaseOS AUS (v.8.6) cups 2.2.6-45.el8_6.5, cups-libs 2.2.6-45.el8_6.5 Red Hat Enterprise Linux BaseOS E4S (v.8.6) cups 2.2.6-45.el8_6.5, cups-libs 2.2.6-45.el8_6.5
    fixed: vendor fix RHSA-2024:4715
  • Red Hat Enterprise Linux BaseOS EUS (v.8.8) cups 2.2.6-51.el8_8.4, cups-libs 2.2.6-51.el8_8.4
    fixed: vendor fix RHSA-2024:4580
  • Red Hat Enterprise Linux BaseOS EUS (v.9.2) cups 2.3.3op2-16.el9_2.2, cups-libs 2.3.3op2-16.el9_2.2
    fixed: vendor fix RHSA-2024:5644
  • Red Hat Enterprise Linux BaseOS TUS (v.8.6) cups 2.2.6-45.el8_6.5, cups-libs 2.2.6-45.el8_6.5
    fixed: vendor fix RHSA-2024:4715
  • Red Hat Enterprise Linux 10 cups
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
partial
Assessed
2 y ago

Exploit prediction

2.42% chance of exploitation in the next 30 days, higher than 84% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f referenced PoC, tagged "exploit" by a source, unverified
  • openwall.com http://www.openwall.com/lists/oss-security/2024/06/11/1 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
NVD 3.1 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products

  • OpenPrinting cups

Classification

Weakness
  • CWE-59 Improper Link Resolution Before File Access
  • CWE-252 Unchecked Return Value

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.