Information disclosure in shadow - CVE-2023-4641

Vulnerability identifier: #VU80801

CSH Severity: Low

CVSS v4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-4641

CWE-ID: CWE-200

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to an error in gpasswd(1), which fails to clean memory properly. When asking for a new password, shadow-utils asks the password twice. If the password fails on the second attempt, shadow-utils fails in cleaning the buffer used to store the first entry. A local user with enough access can retrieve the password from the memory.

shadow
Oracle Linux
Amazon Linux AMI
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise High Performance Computing 12
SUSE CaaS Platform
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
SUSE Enterprise Storage
Red Hat CodeReady Linux Builder for IBM z Systems
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Anolis OS
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Ubuntu
SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS
SUSE Linux Enterprise Server 15 SP1 LTSS
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP3 LTSS
Basesystem Module
openSUSE Leap
openEuler
Red Hat OpenShift Builds
Migration Toolkit for Runtimes
Service Telemetry Framework
OpenShift Pipelines
Red Hat Advanced Cluster Security for Kubernetes
OpenShift Logging
Oracle Communications Cloud Native Core Binding Support Function
Netcool Operations Insight
IBM MQ Operator
Cryostat
Red Hat Advanced Cluster Management for Kubernetes
Red Hat OpenShift distributed tracing (RHOSDT)
Red Hat OpenShift Dev Spaces
App Connect Enterprise Certified Container
Red Hat Migration Toolkit for Applications
IBM Security Verify Governance
IBM Power Hardware Management Console (HMC)
IBM Cloud Pak for Business Automation
Migration Toolkit for Containers
Red Hat OpenShift Container Platform
Red Hat OpenShift GitOps
Cognos Dashboards on Cloud Pak for Data
webMethods Managed File Transfer
ObjectScale
Cloud Pak for Network Automation
Dell EMC PowerStore Family Operating System
IBM Cloud Pak for Watson AIOps
OpenShift Data Foundation (formerly OpenShift Container Storage)
OpenShift Virtualization
OpenShift Service Mesh
LANTIME Operating System Firmware (LTOS)
Red Hat Single Sign-On
Oracle Communications Cloud Native Core Policy
uidmap (Ubuntu package)
passwd (Ubuntu package)
login (Ubuntu package)
shadow-utils
shadow-debugsource
shadow-debuginfo
shadow
shadow-utils (Red Hat package)
shadow-utils-doc
shadow-utils-subid-devel
shadow-utils-subid
shadow-help
login_defs
libsubid-dev (Ubuntu package)
libsubid4 (Ubuntu package)
libsubid-devel
libsubid5
libsubid5-debuginfo
RecoverPoint for VMs
Red Hat Ceph Storage
Dell EMC VxRail Appliance
IBM CICS TX Advanced
Dell EMC NetWorker vProxy

Install updates from vendor's website.

shadow - update to 4.14.0
Red Hat OpenShift Builds - update to 1.0.1
Migration Toolkit for Runtimes - addressed in versions 1.2.3, 1.2.4
Service Telemetry Framework - update to 1.5.4
Migration Toolkit for Containers - addressed in versions 1.7.15, 1.8.3
Red Hat OpenShift GitOps - addressed in versions 1.9.3, 1.10.0, 1.11
OpenShift Pipelines - update to 1.10.6
Red Hat Advanced Cluster Security for Kubernetes - addressed in versions 3.74.8, 4.1.6, 4.3.1
OpenShift Data Foundation (formerly OpenShift Container Storage) - update to 4.12.10
Red Hat OpenShift Container Platform - addressed in versions 4.12.53, 4.16.15, 4.17.0
OpenShift Virtualization - addressed in versions 4.12.9, 4.13.6, 4.14.1
OpenShift Logging - addressed in versions 5.7.10, 5.8.1
LANTIME Operating System Firmware (LTOS) - update to 7.08.010
Red Hat Single Sign-On - update to 7.6.6
uidmap (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 1:4.8.1-1ubuntu5.20.04.5, 1:4.8.1-2ubuntu2.2, 1:4.13+dfsg1-1ubuntu1.1
passwd (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 1:4.8.1-1ubuntu5.20.04.5, 1:4.8.1-2ubuntu2.2, 1:4.13+dfsg1-1ubuntu1.1
login (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 1:4.8.1-1ubuntu5.20.04.5, 1:4.8.1-2ubuntu2.2, 1:4.13+dfsg1-1ubuntu1.1
ObjectScale - update to 1.4.0
Netcool Operations Insight - update to 1.6.12
IBM MQ Operator - addressed in versions 2.0.17, 3.0.0
Cryostat - update to 2.4.0
OpenShift Service Mesh - addressed in versions 2.4.8, 2.5.2
Cloud Pak for Network Automation - update to 2.6.4
Red Hat Advanced Cluster Management for Kubernetes - addressed in versions 2.10.5, 2.12.0
Red Hat OpenShift distributed tracing (RHOSDT) - update to 3.0.0
Red Hat OpenShift Dev Spaces - update to 3.16.0
Dell EMC PowerStore Family Operating System - update to 4.0.0.0-2284811
shadow-utils - addressed in versions 4.1.4.2-13.11, 4.9-12
shadow-debugsource - addressed in versions 4.2.1-36.6.1, 4.6-150100.3.11.1, 4.8.1-150300.4.12.1, 4.8.1-150400.3.3.1, 4.8.1-150400.10.12.1, 4.17.2-150600.17.18.1
shadow-debuginfo - addressed in versions 4.2.1-36.6.1, 4.6-150100.3.11.1, 4.8.1-150300.4.12.1, 4.8.1-150400.3.3.1, 4.8.1-150400.10.12.1, 4.17.2-150600.17.18.1
shadow - addressed in versions 4.2.1-36.6.1, 4.6-150100.3.11.1, 4.8.1-150300.4.12.1, 4.8.1-150400.3.3.1, 4.8.1-150400.10.12.1, 4.17.2-150600.17.18.1
IBM Cloud Pak for Watson AIOps - update to 4.4.1
shadow-utils (Red Hat package) - addressed in versions 4.6-17.el8_8.2, 4.6-19.el8, 4.9-8.el9
shadow-utils-doc - addressed in versions 4.6-19.0.1, 4.13-3
shadow-utils-subid-devel - addressed in versions 4.6-19.0.1, 4.13-3
shadow-utils - addressed in versions 4.6-19.0.1, 4.13-3
shadow-utils-subid - addressed in versions 4.6-19.0.1, 4.13-3
shadow - update to 4.8.1-9
shadow-debuginfo - update to 4.8.1-9
shadow-debugsource - update to 4.8.1-9
shadow-help - update to 4.8.1-9
login_defs - addressed in versions 4.8.1-150300.4.12.1, 4.8.1-150400.3.3.1, 4.8.1-150400.10.12.1, 4.17.2-150600.17.18.1
libsubid-dev (Ubuntu package) - update to 1:4.13+dfsg1-1ubuntu1.1
libsubid4 (Ubuntu package) - update to 1:4.13+dfsg1-1ubuntu1.1
libsubid-devel - update to 4.17.2-150600.17.18.1
libsubid5 - update to 4.17.2-150600.17.18.1
libsubid5-debuginfo - update to 4.17.2-150600.17.18.1
App Connect Enterprise Certified Container - addressed in versions 5.0.14, 11.2.0
RecoverPoint for VMs - update to 6.0.SP1.P1
Red Hat Ceph Storage - update to 6.1
Red Hat Migration Toolkit for Applications - update to 6.2
Dell EMC VxRail Appliance - update to 8.0.201
IBM Security Verify Governance - update to 10.0.2.0.4
IBM CICS TX Advanced - update to 10.1.0.0 ifix29
IBM Power Hardware Management Console (HMC) - addressed in versions 10.2.1040.0 SP2, 10.3.1060.0
Dell EMC NetWorker vProxy - addressed in versions 19.9.0.4, 19.10
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3.32, 23.0.2.4

• https://bugzilla.redhat.com/show_bug.cgi?id=2215945
• https://github.com/shadow-maint/shadow/commit/65c88a43a23c2391dcc90c0abda3e839e9c57904

• Information disclosure in shadow
• SUSE update for shadow
• SUSE update for shadow
• SUSE update for shadow
• SUSE update for shadow
• SUSE update for shadow
• Amazon Linux AMI update for shadow-utils
• Red Hat Enterprise Linux 9 update for shadow-utils
• Multiple vulnerabilities in Oracle Linux
• Red Hat Enterprise Linux 8 update for shadow-utils
• Multiple vulnerabilities in Red Hat OpenShift GitOps 1.9
• Multiple vulnerabilities in OpenShift Virtualization 4.13
• Multiple vulnerabilities in Red Hat Openshift distributed tracing
• Multiple vulnerabilities in Migration Toolkit for Runtimes 1.2
• Multiple vulnerabilities in Red Hat OpenShift Pipelines 1.10
• Multiple vulnerabilities in Red Hat build of Cryostat
• Multiple vulnerabilities in OpenShift Virtualization 4.14
• Multiple vulnerabilities in Red Hat Advanced Cluster Security for Kubernetes 4.3
• Multiple vulnerabilities in Red Hat Ceph Storage 6.1
• Multiple vulnerabilities in Red Hat OpenShift Data Foundation 4.12
• Multiple vulnerabilities in Logging Subsystem 5.8 for Red Hat OpenShift
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6
• Multiple vulnerabilities in IBM MQ Operator
• Multiple vulnerabilities in IBM Cognos Dashboards on Cloud Pak for Data
• Multiple vulnerabilities in IBM Cloud Pak for Network Automation
• Multiple vulnerabilities in OpenShift Virtualization 4.12
• Multiple vulnerabilities in Logging Subsystem 5.7 for Red Hat OpenShift
• Multiple vulnerabilities in Red Hat Advanced Cluster Security for Kubernetes 3.74
• Multiple vulnerabilities in Red Hat Advanced Cluster Security for Kubernetes 4.1
• Dell EMC NetWorker vProxy update for third-party components
• Multiple vulnerabilities in Migration Toolkit for Runtimes 1.2
• Multiple vulnerabilities in IBM App Connect Enterprise Certified Container
• Ubuntu update for shadow
• Multiple vulnerabilities in IBM Cloud Pak for AIOps
• Multiple vulnerabilities in Red Hat Migration Toolkit for Applications
• openEuler update for shadow
• Multiple vulnerabilities in Service Telemetry Framework 1.5
• Multiple vulnerabilities in Red Hat OpenShift GitOps
• Multiple vulnerabilities in Red Hat OpenShift GitOps
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.12
• Multiple vulnerabilities in Netcool Operations Insight
• Multiple vulnerabilities in Red Hat OpenShift Builds
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Policy
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Binding Support Function
• Multiple vulnerabilities in Red Hat Migration Toolkit for Containers (MTC) 1.8
• Red Hat Enterprise Linux 8.8 Extended Update Support update for shadow-utils
• Multiple vulnerabilities in Red Hat Migration Toolkit for Containers (MTC) 1.7
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• Multiple vulnerabilities in OpenShift Service Mesh 2.5
• Multiple vulnerabilities in OpenShift Service Mesh 2.4
• Multiple vulnerabilities in Dell PowerStore Family
• Multiple vulnerabilities in Dell ObjectScale
• Multiple vulnerabilities in IBM CICS TX Advanced
• Information disclosure in IBM Power HMC
• Multiple vulnerabilities in Red Hat OpenShift Dev Spaces
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.10
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.16
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.17
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.17
• Multiple vulnerabilities in IBM Security Verify Governance - Identity Manager
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.12
• Multiple vulnerabilities in Dell RecoverPoint for Virtual Machines
• Amazon Linux AMI update for shadow-utils
• Anolis OS update for shadow-utils
• Anolis OS update for shadow-utils
• Multiple vulnerabilities in Dell EMC VxRail Appliance
• Multiple vulnerabilities in IBM webMethods Managed File Transfer
• Meinberg LANTIME firmware update for third-party components (April 2024)
• SUSE update for Recommended update for shadow