A newly identified series of four critical vulnerabilities within the Common Unix Printing System (CUPS) has raised significant concerns among security experts regarding the potential implications of these flaws. CUPS is widely used across nearly all GNU/Linux distributions, including Debian, Red Hat, and SUSE, as well as in Apple macOS and Google Chrome/Chromium.
These vulnerabilities were discovered by researcher Simone Margaritelli, also known as evilsocket, who released his initial findings after a limited leak via GitHub that preempted a coordinated disclosure, which was originally planned for October 6. Margaritelli reported that despite his efforts to adhere to a responsible disclosure approach, he faced resistance from developers who were reluctant to acknowledge the seriousness of the issues.
The vulnerabilities are cataloged as CVE-2024-47176, CVE-2024-47076, CVE-2024-47175, and CVE-2024-47177, and it is estimated that collectively, over 76,000 devices—including 42,000 that allow public access—could be at risk. Margaritelli suggested that the actual number may be between 200,000 and 300,000 affected devices, urging users to disable and uninstall CUPS services if they are not necessary.
CUPS functions as a standardized printing system for Unix-like operating systems, allowing computers to operate as print servers. In certain cases, it is enabled by default, resulting in widespread use. When exploited in combination, these vulnerabilities enable an unauthenticated attacker to execute remote code on vulnerable systems by adding a “ghost” printer with a malicious Internet Printing Protocol (IPP) URL and initiating a print job. However, it’s important to note that attackers cannot trigger a print job independently; the attack relies on the submission of a print job to the compromised system.
According to Saeed Abbasi, product manager for the Qualys Threat Research Unit, “These vulnerabilities permit a remote, unauthenticated attacker to silently replace existing IPP URLs with malicious ones, potentially resulting in arbitrary command execution when a print job is activated. An attacker can exploit these vulnerabilities by sending a specially crafted UDP packet to port 631 over the public internet without requiring any authentication.”
Abbasi emphasized that since GNU/Linux systems are prevalent in enterprise servers, cloud infrastructure, and mission-critical applications, the vulnerabilities present a substantial attack surface, potentially impacting numerous servers, desktops, and embedded devices globally. With a CVSS score of 9.9, these vulnerabilities are deemed critical, allowing attackers to execute arbitrary code and potentially gain complete control over affected systems. He advised enterprises to evaluate their exposure risk related to CUPS systems, limit network access, deactivate unnecessary services, implement stringent access controls, and prepare for prompt patching once available.
The high CVSS score has led some to compare this vulnerability chain to Log4Shell—a serious vulnerability found in the Apache Log4j2 Java logging library in 2021 that continues to have repercussions. Brian Fox, a governing board member of the Open Source Security Foundation (OSSF) and CTO of Sonatype, remarked, “Successful exploitation could be catastrophic—everything from Wi-Fi routers to critical infrastructure relies on Linux. The combination of low complexity and high usage is reminiscent of Log4Shell, with an even broader impact in this instance.”
Fox noted the rationale behind delaying disclosure, as addressing the vulnerability will take time, but he urged that threat actors would be actively scrutinizing the commit history for exploitation opportunities. He advised security teams within enterprises to thoroughly assess their environments and Software Bill of Materials (SBOMs) for potential vulnerabilities and to be ready to implement patches quickly.
Conversely, the research team at JFrog adopted a more cautious stance, refraining from likening the CUPS vulnerabilities to a Log4Shell-level incident, suggesting that the conditions for exploitation are not particularly common. “Although no fixed versions have been released for the upstream projects or any Linux distributions, those affected can mitigate these vulnerabilities without an upgrade by disabling and removing the CUPS-browsed service and blocking all traffic to UDP port 631 along with all DNS-SD traffic,” stated Shachar Menashe, senior director of JFrog Security Research.