bencteux.fradvisory

CVE-2024-50306: Unchecked return value in Apache Traffic Server

Writeup of CVE-2024-50306, a vulnerability in Apache Traffic Server (versions 9.0.0-9.2.5 and 10.0.0-10.0.1) where the code fails to check the return value of initgroups() when dropping privileges after startup. If the call fails, the process believes it has dropped supplementary group memberships when it has not, potentially leaving it in a privileged group and enabling privilege escalation. Fixed in ATS 9.2.6/10.0.2 by aborting execution on failure.