CVE-2025-64996: Checkmk Vulnerability Exposes Monitoring Data via Insecure File Permissions

Overview

This article discusses CVE-2025-64996, a vulnerability affecting Checkmk versions prior to 2.4.0p16, 2.3.0p41, and all versions of 2.2.0 and older. This vulnerability stems from the mk_inotify plugin creating world-readable and writable files, potentially allowing local users to read and manipulate monitoring data.

Technical Details

The mk_inotify plugin is designed to monitor file system events using the inotify Linux kernel subsystem. Due to a misconfiguration in affected Checkmk versions, the plugin creates files with overly permissive file permissions (world-readable and writable). This means any local user on the system where Checkmk is running can access these files.

This access allows an attacker to:

• Read plugin output: Gain insights into monitored file system activity, potentially revealing sensitive information.
• Manipulate plugin output: Modify the data reported by the plugin, leading to false alerts or masking real security incidents.

CVSS Analysis

Currently, a CVSS score is not available for CVE-2025-64996. While the vulnerability allows for local privilege escalation, the impact is limited to the Checkmk monitoring data. The severity is therefore marked as N/A.

Possible Impact

The impact of this vulnerability can be significant, especially in environments where accurate monitoring data is critical. An attacker could leverage this vulnerability to:

• Cause Denial of Service (DoS): By manipulating monitoring data, an attacker could trigger false alerts, overloading monitoring systems and distracting administrators.
• Hide Malicious Activity: An attacker could modify the plugin’s output to conceal malicious file system activity, making it difficult to detect security breaches.
• Gain Unauthorized Access: While not a direct access vulnerability, insights gained from monitoring data could aid in other attack vectors.

Mitigation or Patch Steps

The recommended mitigation is to upgrade your Checkmk installation to one of the following versions or later:

• Checkmk 2.4.0p16
• Checkmk 2.3.0p41

If upgrading is not immediately feasible, consider implementing the following temporary workarounds (although these are less secure than upgrading):

• Restrict access to the directories where the mk_inotify plugin creates its files using appropriate file system permissions (e.g., using chmod and chown).
• Disable the mk_inotify plugin if it is not essential for your monitoring needs.

Note: Ensure to thoroughly test any changes in a non-production environment before applying them to production systems.

References

• Checkmk Werk 18570: Security Advisory