shadow-maint shadow-utils up to 4.17.0 Home Directory /etc/subuid insecure default initialization of resource ⚔ [Disputed]

Summaryinfo

A vulnerability marked as critical has been reported in shadow-maint shadow-utils up to 4.17.0. This affects an unknown part of the file /etc/subuid of the component Home Directory Handler. Performing a manipulation results in insecure default initialization of resource. This vulnerability is known as CVE-2024-56433. Attacking locally is a requirement. No exploit is available. There are still doubts about whether this vulnerability truly exists.

Detailsinfo

A vulnerability, which was classified as critical, was found in shadow-maint shadow-utils up to 4.17.0. This affects an unknown code of the file /etc/subuid of the component Home Directory Handler. The manipulation with an unknown input leads to a insecure default initialization of resource vulnerability. CWE is classifying the issue as CWE-1188. The product initializes or sets a resource with a default that is intended to be changed by the administrator, but the default is not secure. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users). NOTE: it may also be argued that system administrators should not have assigned uids, within local networks, that are within the range that can occur in /etc/subuid.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2024-56433 since 12/26/2024. The exploitability is told to be difficult. Attacking locally is a requirement. Technical details of the vulnerability are known, but there is no available exploit.

The real existence of this vulnerability is still doubted at the moment. The vulnerability scanner Nessus provides a plugin with the ID 230845 (Linux Distros Unpatched Vulnerability : CVE-2024-56433), which helps to determine the existence of the flaw in a target environment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at Tenable (230845), EUVD (EUVD-2024-53142) and CERT Bund (WID-SEC-2024-3754). Be aware that VulDB is the high quality source for vulnerability data.

Affected

• Fedora Linux
• F5 BIG-IP
• Open Source shadow

Productinfo

Vendor

• shadow-maint

Name

• shadow-utils

Version

• 4.0
• 4.1
• 4.2
• 4.3
• 4.4
• 4.5
• 4.6
• 4.7
• 4.8
• 4.9
• 4.10
• 4.11
• 4.12
• 4.13
• 4.14
• 4.15
• 4.16
• 4.17.0

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion