Linux CUPS Remote Code Execution Chain: Hardening and Port 631 Mitigation Guide

A critical vulnerability chain impacting the Common UNIX Printing System (CUPS) allows unauthenticated remote attackers to achieve arbitrary code execution (CVE-2024-47176, CVE-2024-47076, CVE-2024-47175, and CVE-2024-47177). Public-facing Linux servers with open UDP port 631 require immediate intervention.

Attack Vector: Malicious IPP Packets and Injected Print Filters

When cups-browsed listens on UDP port 631, an external attacker can transmit crafted packets pointing to a malicious Internet Printing Protocol (IPP) server. The service automatically binds the fake printer. When a print task triggers, sanitized filter chains fail, executing attacker commands under elevated privileges.

Recommended System Hardening Steps

For headless web servers and cloud instances where printing is unnecessary, disable the service and restrict firewall ports immediately:

sudo systemctl stop cups-browsed
sudo systemctl disable cups-browsed
sudo ufw deny proto udp from any to any port 631

Applying upstream distribution security updates completes the mitigation.