Permissions, Privileges, and Access Controls in shadow - CVE-2024-56433

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU113028

Permissions, Privileges, and Access Controls in shadow - CVE-2024-56433

Published: July 17, 2025


Vulnerability identifier: #VU113028
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2024-56433
CWE-ID: CWE-264
Exploitation vector: Adjecent network
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote user to escalate privileges on the system.

The vulnerability exists due to shadow-utils establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users).


Affected software

shadow
BIG-IP Next CNF
BIG-IP Next SPK
BIG-IP Next for Kubernetes
Fedora
DataStax Hyper-Converged Database
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
AppDynamics NodeJS Agent
Cryostat
shadow-utils

How to mitigate CVE-2024-56433

Install updates from vendor's website.

shadow - update to 4.17.1
DataStax Hyper-Converged Database - update to 1.2.5
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 5.3
AppDynamics NodeJS Agent - update to 25.12.1
Cryostat - update to 4.1.0
shadow-utils - update to 4.17.4-2.fc42

External References

Related Security Bulletins