CVE-2018-7169
LowSummary
An issue was discovered in shadow 4.5. newgidmap (in shadow-utils) is setuid and allows an unprivileged user to be placed in a user namespace where setgroups(2) is permitted. This allows an attacker to remove themselves from a supplementary group, which may allow access to certain filesystem paths.
Risk Assessment
The risk involves potential privilege escalation or access control bypass, which could lead to unauthorized access to sensitive data or the system.
Recommendation
It is recommended to immediately update shadow-utils to a version after 4.5 that fixes this vulnerability, and to restrict setuid permissions on newgidmap if possible.
Other vulnerabilities in shadow-utils
See all- CVE-2023-4641Medium
A flaw in shadow-utils fails to properly clear the buffer when a new password is entered twice and the second attempt fails. This leaves the first password in memory, potentially allowing an attacker with sufficient access to retrieve it.
- CVE-2024-56433Low
shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users).
Original NVD description (English source)
An issue was discovered in shadow 4.5. newgidmap (in shadow-utils) is setuid and allows an unprivileged user to be placed in a user namespace where setgroups(2) is permitted. This allows an attacker to remove themselves from a supplementary group, which may allow access to certain filesystem paths i
Vulnerability data from NVD (NIST) · CISA KEV · EPSS