Information disclosure in shadow - CVE-2023-4641

Vulnerability identifier: #VU80801

CSH Severity: Low

CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

CVE-ID: CVE-2023-4641

CWE-ID: CWE-200

Exploitation vector: Local access

Exploit availability: No public exploit available

Affected software:
shadow
Oracle Linux
Amazon Linux AMI
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise High Performance Computing 12
SUSE CaaS Platform
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
SUSE Enterprise Storage
Red Hat CodeReady Linux Builder for IBM z Systems
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Anolis OS
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Ubuntu
SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS
SUSE Linux Enterprise Server 15 SP1 LTSS
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP3 LTSS
Basesystem Module
openSUSE Leap
openEuler
Red Hat OpenShift Builds
Migration Toolkit for Runtimes
Service Telemetry Framework
OpenShift Pipelines
Red Hat Advanced Cluster Security for Kubernetes
OpenShift Logging
Oracle Communications Cloud Native Core Binding Support Function
Netcool Operations Insight
IBM MQ Operator
Cryostat
Red Hat Advanced Cluster Management for Kubernetes
Red Hat OpenShift distributed tracing (RHOSDT)
Red Hat OpenShift Dev Spaces
App Connect Enterprise Certified Container
Red Hat Migration Toolkit for Applications
IBM Security Verify Governance
IBM Power Hardware Management Console (HMC)
IBM Cloud Pak for Business Automation
Migration Toolkit for Containers
Red Hat OpenShift Container Platform
Red Hat OpenShift GitOps
Cognos Dashboards on Cloud Pak for Data
webMethods Managed File Transfer
ObjectScale
Cloud Pak for Network Automation
Dell EMC PowerStore Family Operating System
IBM Cloud Pak for Watson AIOps
OpenShift Data Foundation (formerly OpenShift Container Storage)
OpenShift Virtualization
OpenShift Service Mesh
LANTIME Operating System Firmware (LTOS)
Red Hat Single Sign-On
Oracle Communications Cloud Native Core Policy
uidmap (Ubuntu package)
passwd (Ubuntu package)
login (Ubuntu package)
shadow-utils
shadow-debugsource
shadow-debuginfo
shadow
shadow-utils (Red Hat package)
shadow-utils-doc
shadow-utils-subid-devel
shadow-utils-subid
shadow-help
login_defs
libsubid-dev (Ubuntu package)
libsubid4 (Ubuntu package)
libsubid-devel
libsubid5
libsubid5-debuginfo
RecoverPoint for VMs
Red Hat Ceph Storage
Dell EMC VxRail Appliance
IBM CICS TX Advanced
Dell EMC NetWorker vProxy

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to an error in gpasswd(1), which fails to clean memory properly. When asking for a new password, shadow-utils asks the password twice. If the password fails on the second attempt, shadow-utils fails in cleaning the buffer used to store the first entry. A local user with enough access can retrieve the password from the memory.

Install updates from vendor's website.

• https://bugzilla.redhat.com/show_bug.cgi?id=2215945
• https://github.com/shadow-maint/shadow/commit/65c88a43a23c2391dcc90c0abda3e839e9c57904