CVE-2024-2975
Octopus Server 0.9 – 2023.4.8432
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2024-2975 is a high-severity Race Condition for Write-Once Attributes (CWE-1223) vulnerability in Octopus Octopus Server. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Abuse Elevation Control Mechanism (T1548); ranked at the 32th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-27915
Vulnerability Data
A race condition was identified through which privilege escalation was possible in certain configurations.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Access enforcement directly stops untrusted software from writing the register before the trusted component by enforcing authorization rules on the hardware interface.
Least privilege restricts write access to the register to only the trusted software component, eliminating the window for premature untrusted writes.
Information flow enforcement can block unauthorized early writes by controlling data paths to the register from untrusted components.
Security function isolation keeps the write-once mechanism and its trusted initializer separate from untrusted software execution domains.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Hardware integrity assessment prior to acquisition can surface design flaws such as unsafe write-once register ordering.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure system architecture and engineering principles can mandate hardware access ordering and initialization sequencing to prevent race conditions.
Security testing in development can include hardware simulation and formal verification to catch write-once register race conditions.
Secure development lifecycle practices can include hardware design reviews that detect write-once register race conditions.
Secure coding guidelines for hardware description languages can enforce proper write-once attribute protection and initialization order.
Change management processes may review hardware design changes but do not directly prevent race conditions in write-once registers.