Log in Start free

Vulnerability · Published Apr 14, 2023 · Assigned by mitre

CVE-2023-29383

Low 3.3

In plain English

A low-severity out-of-bounds read in the shadow package (Alpine). Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)3.3Low
Exploit odds (30 days)0.4%top 62.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn (change finger). Although it is not possible to exploit this directly (e.g., adding a new user fails because \n is in the block list), it is possible to misrepresent the /etc/passwd file when viewed. Use of \r manipulations and Unicode characters to work around blocking of the : character make it possible to give the impression that a new user has been added. In other words, an adversary may be able to convince a system administrator to take the system offline (an indirect, social-engineered denial of service) by demonstrating that "cat /etc/passwd" shows a rogue user account.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20shadow4.13-r4ALPINE-CVE-2023-29383
Alpine:v3.21shadow4.13-r4ALPINE-CVE-2023-29383
Alpine:v3.22shadow4.13-r4ALPINE-CVE-2023-29383
Alpine:v3.23shadow4.13-r4ALPINE-CVE-2023-29383
Alpine:v3.24shadow4.13-r4ALPINE-CVE-2023-29383
Debian:12shadow1:4.13+dfsg1-1+deb12u1DEBIAN-CVE-2023-29383
Debian:13shadow1:4.13+dfsg1-2DEBIAN-CVE-2023-29383
Debian:14shadow1:4.13+dfsg1-2DEBIAN-CVE-2023-29383
Ubuntu:22.04:LTSshadowno fix listedUBUNTU-CVE-2023-29383

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-125

References