CVE-2023-4641
MediumSummary
A flaw in shadow-utils fails to properly clear the buffer when a new password is entered twice and the second attempt fails. This leaves the first password in memory, potentially allowing an attacker with sufficient access to retrieve it.
Risk Assessment
The risk involves potential leakage of user passwords, which could lead to unauthorized access to systems and sensitive data.
Recommendation
It is recommended to immediately update the shadow-utils package to the latest available version that includes a fix for this vulnerability.
Other vulnerabilities in shadow-utils
See all- CVE-2018-7169Low
An issue was discovered in shadow 4.5. newgidmap (in shadow-utils) is setuid and allows an unprivileged user to be placed in a user namespace where setgroups(2) is permitted. This allows an attacker to remove themselves from a supplementary group, which may allow access to certain filesystem paths.
- CVE-2024-56433Low
shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users).
Original NVD description (English source)
A flaw was found in shadow-utils. When asking for a new password, shadow-utils asks the password twice. If the password fails on the second attempt, shadow-utils fails in cleaning the buffer used to store the first entry. This may allow an attacker with enough access to retrieve the password from th
Vulnerability data from NVD (NIST) · CISA KEV · EPSS