CVE-2024-56433
LowCVSS 3.6Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users).
Risk Assessment
Account takeover or unauthorized access to NFS and local resources is possible if local network uid ranges overlap with the default /etc/subuid range.
Recommendation
Update shadow-utils to a patched version and ensure that uids in local networks do not fall within the range that can occur in /etc/subuid.
Other vulnerabilities in shadow-utils
See all- CVE-2023-4641Medium
A flaw in shadow-utils fails to properly clear the buffer when a new password is entered twice and the second attempt fails. This leaves the first password in memory, potentially allowing an attacker with sufficient access to retrieve it.
- CVE-2018-7169Low
An issue was discovered in shadow 4.5. newgidmap (in shadow-utils) is setuid and allows an unprivileged user to be placed in a user namespace where setgroups(2) is permitted. This allows an attacker to remove themselves from a supplementary group, which may allow access to certain filesystem paths.
Original NVD description (English source)
shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users). NOTE: it may also be argued that system administrators should not have assigned uids, within local networks, that are within the range that can occur in /etc/subuid.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS