Race condition in System Security Services Daemon (SSSD) - CVE-2023-3758

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU88857

Race condition in System Security Services Daemon (SSSD) - CVE-2023-3758

Published: April 19, 2024


Vulnerability identifier: #VU88857
CSH Severity: Medium
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-3758
CWE-ID: CWE-362
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote user to escalate privileges on the system.

The vulnerability exists due to a race condition where the GPO policy is not consistently applied for authenticated users. A remote user can exploit the race and gain unauthorized access to the system.


Affected software

System Security Services Daemon (SSSD)
Amazon Linux AMI
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Software Development Kit 12
SUSE Linux Enterprise Real Time 15
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Manager Proxy
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
openSUSE Leap Micro
SUSE Enterprise Storage
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat CodeReady Linux Builder for x86_64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for IBM z Systems
Anolis OS
Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support
Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP3 LTSS
SUSE Linux Enterprise Desktop 15 SP4 LTSS
SUSE Linux Enterprise Server 15 SP4 LTSS
Basesystem Module
openSUSE Leap
openEuler
Ubuntu
Juniper Secure Analytics (JSA)
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
sssd-krb5-common-debuginfo
sssd-ipa-debuginfo
libipa_hbac0-debuginfo
sssd-debugsource
sssd-krb5
libsss_simpleifp0-debuginfo
sssd-ad-debuginfo
libsss_certmap0-debuginfo
sssd
libsss_nss_idmap0-debuginfo
libsss_idmap-devel
libsss_idmap0-debuginfo
sssd-ipa
sssd-tools-debuginfo
sssd-dbus
python-sssd-config
sssd-tools
sssd-common-debuginfo
sssd-common
sssd-proxy
sssd-proxy-debuginfo
libipa_hbac-devel
sssd-common-32bit
sssd-common-debuginfo-32bit
libsss_nss_idmap-devel
libsss_idmap0
libsss_nss_idmap0
sssd-ldap-debuginfo
sssd-ad
sssd-ldap
sssd-krb5-debuginfo
python-sssd-config-debuginfo
sssd-dbus-debuginfo
libipa_hbac0
libsss_simpleifp0
sssd-krb5-common
libsss_certmap0
python3-sssd-config
sssd-winbind-idmap
python3-sssd-config-debuginfo
libsss_certmap-devel
sssd-winbind-idmap-debuginfo
libsss_simpleifp-devel
sssd-common-32bit-debuginfo
python3-ipa_hbac
libnfsidmap-sss
python3-sss_nss_idmap-debuginfo
sssd-wbclient-devel
python3-sss-murmur
sssd-wbclient
python3-sss_nss_idmap
libnfsidmap-sss-debuginfo
sssd-wbclient-debuginfo
sssd-common-64bit-debuginfo
sssd-common-64bit
python3-ipa_hbac-debuginfo
python3-sss-murmur-debuginfo
sssd-help
sssd-devel
sssd-debuginfo
python2-sssd
python3-sssd
sssd (Ubuntu package)
sssd-kcm
sssd-kcm-debuginfo
sssd (Red Hat package)
libsss_autofs (Red Hat package)
libsss_certmap (Red Hat package)
libipa_hbac (Red Hat package)
libsss_certmap-debuginfo (Red Hat package)
libsss_sudo-debuginfo (Red Hat package)
libsss_sudo (Red Hat package)
libsss_simpleifp-debuginfo (Red Hat package)
libsss_simpleifp (Red Hat package)
libsss_nss_idmap-debuginfo (Red Hat package)
libsss_nss_idmap (Red Hat package)
libsss_idmap-debuginfo (Red Hat package)
libsss_idmap (Red Hat package)
sssd-winbind-idmap-debuginfo (Red Hat package)
libsss_autofs-debuginfo (Red Hat package)
libipa_hbac-debuginfo (Red Hat package)
libsss_nss_idmap-devel (Red Hat package)
python3-libipa_hbac-debuginfo (Red Hat package)
python3-libsss_nss_idmap-debuginfo (Red Hat package)
sssd-tools-debuginfo (Red Hat package)
sssd-proxy-debuginfo (Red Hat package)
sssd-nfs-idmap-debuginfo (Red Hat package)
sssd-ldap-debuginfo (Red Hat package)
sssd-krb5-debuginfo (Red Hat package)
sssd-krb5-common-debuginfo (Red Hat package)
sssd-kcm-debuginfo (Red Hat package)
sssd-ipa-debuginfo (Red Hat package)
sssd-idp (Red Hat package)
sssd-debugsource (Red Hat package)
python3-sss-murmur (Red Hat package)
python3-sss (Red Hat package)
python3-libsss_nss_idmap (Red Hat package)
python3-libipa_hbac (Red Hat package)
python3-sssdconfig
sssd-client
sssd-common-pac
sssd-idp
sssd-nfs-idmap
sssd-polkit-rules
python3-sss
libipa_hbac
libsss_autofs
libsss_certmap
libsss_idmap
libsss_nss_idmap
libsss_simpleifp
libsss_sudo
python3-libipa_hbac
python3-libsss_nss_idmap
Red Hat Ceph Storage
IBM Qradar SIEM
EMC Cloud Tiering Appliance

How to mitigate CVE-2023-3758

Install updates from vendor's website.

Juniper Secure Analytics (JSA) - update to 7.5.0 UP8 IF03
sssd-krb5-common-debuginfo - addressed in versions 1.16.1-7.61.1, 1.16.1-150200.17.32.1, 1.16.1-150300.23.43.1, 2.5.2-150400.4.27.1, 2.5.2-150500.10.17.1
sssd-ipa-debuginfo - addressed in versions 1.16.1-7.61.1, 1.16.1-150200.17.32.1, 1.16.1-150300.23.43.1, 2.5.2-150400.4.27.1, 2.5.2-150500.10.17.1
libipa_hbac0-debuginfo - addressed in versions 1.16.1-7.61.1, 1.16.1-150200.17.32.1, 1.16.1-150300.23.43.1, 2.5.2-150400.4.27.1, 2.5.2-150500.10.17.1
sssd-debugsource - addressed in versions 1.16.1-7.61.1, 1.16.1-150200.17.32.1, 1.16.1-150300.23.43.1, 2.5.2-150400.4.27.1, 2.5.2-150500.10.17.1
sssd-krb5 - addressed in versions 1.16.1-7.61.1, 1.16.1-150200.17.32.1, 1.16.1-150300.23.43.1, 2.5.2-150400.4.27.1, 2.5.2-150500.10.17.1
libsss_simpleifp0-debuginfo - addressed in versions 1.16.1-7.61.1, 1.16.1-150200.17.32.1, 1.16.1-150300.23.43.1, 2.5.2-150400.4.27.1, 2.5.2-150500.10.17.1
sssd-ad-debuginfo - addressed in versions 1.16.1-7.61.1, 1.16.1-150200.17.32.1, 1.16.1-150300.23.43.1, 2.5.2-150400.4.27.1, 2.5.2-150500.10.17.1
libsss_certmap0-debuginfo - addressed in versions 1.16.1-7.61.1, 1.16.1-150200.17.32.1, 1.16.1-150300.23.43.1, 2.5.2-150400.4.27.1, 2.5.2-150500.10.17.1
sssd - addressed in versions 1.16.1-7.61.1, 1.16.1-150200.17.32.1, 1.16.1-150300.23.43.1, 2.5.2-150400.4.27.1, 2.5.2-150500.10.17.1
libsss_nss_idmap0-debuginfo - addressed in versions 1.16.1-7.61.1, 1.16.1-150200.17.32.1, 1.16.1-150300.23.43.1, 2.5.2-150400.4.27.1, 2.5.2-150500.10.17.1
libsss_idmap-devel - addressed in versions 1.16.1-7.61.1, 1.16.1-150200.17.32.1, 1.16.1-150300.23.43.1, 2.5.2-150400.4.27.1, 2.5.2-150500.10.17.1
libsss_idmap0-debuginfo - addressed in versions 1.16.1-7.61.1, 1.16.1-150200.17.32.1, 1.16.1-150300.23.43.1, 2.5.2-150400.4.27.1, 2.5.2-150500.10.17.1
sssd-ipa - addressed in versions 1.16.1-7.61.1, 1.16.1-150200.17.32.1, 1.16.1-150300.23.43.1, 2.5.2-150400.4.27.1, 2.5.2-150500.10.17.1
sssd-tools-debuginfo - addressed in versions 1.16.1-7.61.1, 1.16.1-150200.17.32.1, 1.16.1-150300.23.43.1, 2.5.2-150400.4.27.1, 2.5.2-150500.10.17.1
sssd-dbus - addressed in versions 1.16.1-7.61.1, 1.16.1-150200.17.32.1, 1.16.1-150300.23.43.1, 2.5.2-150400.4.27.1, 2.5.2-150500.10.17.1
python-sssd-config - update to 1.16.1-7.61.1
sssd-tools - addressed in versions 1.16.1-7.61.1, 1.16.1-150200.17.32.1, 1.16.1-150300.23.43.1, 2.5.2-150400.4.27.1, 2.5.2-150500.10.17.1
sssd-common-debuginfo - addressed in versions 1.16.1-7.61.1, 1.16.1-150200.17.32.1, 1.16.1-150300.23.43.1, 2.5.2-150400.4.27.1, 2.5.2-150500.10.17.1
sssd-common - addressed in versions 1.16.1-7.61.1, 1.16.1-150200.17.32.1, 1.16.1-150300.23.43.1, 2.5.2-150400.4.27.1, 2.5.2-150500.10.17.1
sssd-proxy - addressed in versions 1.16.1-7.61.1, 1.16.1-150200.17.32.1, 1.16.1-150300.23.43.1, 2.5.2-150400.4.27.1, 2.5.2-150500.10.17.1
sssd-proxy-debuginfo - addressed in versions 1.16.1-7.61.1, 1.16.1-150200.17.32.1, 1.16.1-150300.23.43.1, 2.5.2-150400.4.27.1, 2.5.2-150500.10.17.1
libipa_hbac-devel - addressed in versions 1.16.1-7.61.1, 1.16.1-150200.17.32.1, 1.16.1-150300.23.43.1, 2.5.2-150400.4.27.1, 2.5.2-150500.10.17.1
sssd-common-32bit - addressed in versions 1.16.1-7.61.1, 1.16.1-150200.17.32.1, 1.16.1-150300.23.43.1, 2.5.2-150400.4.27.1, 2.5.2-150500.10.17.1
sssd-common-debuginfo-32bit - update to 1.16.1-7.61.1
libsss_nss_idmap-devel - addressed in versions 1.16.1-7.61.1, 1.16.1-150200.17.32.1, 1.16.1-150300.23.43.1, 2.5.2-150400.4.27.1, 2.5.2-150500.10.17.1
libsss_idmap0 - addressed in versions 1.16.1-7.61.1, 1.16.1-150200.17.32.1, 1.16.1-150300.23.43.1, 2.5.2-150400.4.27.1, 2.5.2-150500.10.17.1
libsss_nss_idmap0 - addressed in versions 1.16.1-7.61.1, 1.16.1-150200.17.32.1, 1.16.1-150300.23.43.1, 2.5.2-150400.4.27.1, 2.5.2-150500.10.17.1
sssd-ldap-debuginfo - addressed in versions 1.16.1-7.61.1, 1.16.1-150200.17.32.1, 1.16.1-150300.23.43.1, 2.5.2-150400.4.27.1, 2.5.2-150500.10.17.1
sssd-ad - addressed in versions 1.16.1-7.61.1, 1.16.1-150200.17.32.1, 1.16.1-150300.23.43.1, 2.5.2-150400.4.27.1, 2.5.2-150500.10.17.1
sssd-ldap - addressed in versions 1.16.1-7.61.1, 1.16.1-150200.17.32.1, 1.16.1-150300.23.43.1, 2.5.2-150400.4.27.1, 2.5.2-150500.10.17.1
sssd-krb5-debuginfo - addressed in versions 1.16.1-7.61.1, 1.16.1-150200.17.32.1, 1.16.1-150300.23.43.1, 2.5.2-150400.4.27.1, 2.5.2-150500.10.17.1
python-sssd-config-debuginfo - update to 1.16.1-7.61.1
sssd-dbus-debuginfo - addressed in versions 1.16.1-7.61.1, 1.16.1-150200.17.32.1, 1.16.1-150300.23.43.1, 2.5.2-150400.4.27.1, 2.5.2-150500.10.17.1
libipa_hbac0 - addressed in versions 1.16.1-7.61.1, 1.16.1-150200.17.32.1, 1.16.1-150300.23.43.1, 2.5.2-150400.4.27.1, 2.5.2-150500.10.17.1
libsss_simpleifp0 - addressed in versions 1.16.1-7.61.1, 1.16.1-150200.17.32.1, 1.16.1-150300.23.43.1, 2.5.2-150400.4.27.1, 2.5.2-150500.10.17.1
sssd-krb5-common - addressed in versions 1.16.1-7.61.1, 1.16.1-150200.17.32.1, 1.16.1-150300.23.43.1, 2.5.2-150400.4.27.1, 2.5.2-150500.10.17.1
libsss_certmap0 - addressed in versions 1.16.1-7.61.1, 1.16.1-150200.17.32.1, 1.16.1-150300.23.43.1, 2.5.2-150400.4.27.1, 2.5.2-150500.10.17.1
python3-sssd-config - addressed in versions 1.16.1-150200.17.32.1, 1.16.1-150300.23.43.1, 2.5.2-150400.4.27.1, 2.5.2-150500.10.17.1
sssd-winbind-idmap - addressed in versions 1.16.1-150200.17.32.1, 1.16.1-150300.23.43.1, 2.5.2-150400.4.27.1, 2.5.2-150500.10.17.1
python3-sssd-config-debuginfo - addressed in versions 1.16.1-150200.17.32.1, 1.16.1-150300.23.43.1, 2.5.2-150400.4.27.1, 2.5.2-150500.10.17.1
libsss_certmap-devel - addressed in versions 1.16.1-150200.17.32.1, 1.16.1-150300.23.43.1, 2.5.2-150400.4.27.1, 2.5.2-150500.10.17.1
sssd-winbind-idmap-debuginfo - addressed in versions 1.16.1-150200.17.32.1, 1.16.1-150300.23.43.1, 2.5.2-150400.4.27.1, 2.5.2-150500.10.17.1
libsss_simpleifp-devel - addressed in versions 1.16.1-150200.17.32.1, 1.16.1-150300.23.43.1, 2.5.2-150400.4.27.1, 2.5.2-150500.10.17.1
sssd-common-32bit-debuginfo - addressed in versions 1.16.1-150200.17.32.1, 1.16.1-150300.23.43.1, 2.5.2-150400.4.27.1, 2.5.2-150500.10.17.1
python3-ipa_hbac - addressed in versions 1.16.1-150300.23.43.1, 2.5.2-150400.4.27.1, 2.5.2-150500.10.17.1
libnfsidmap-sss - addressed in versions 1.16.1-150300.23.43.1, 2.5.2-150400.4.27.1, 2.5.2-150500.10.17.1
python3-sss_nss_idmap-debuginfo - addressed in versions 1.16.1-150300.23.43.1, 2.5.2-150400.4.27.1, 2.5.2-150500.10.17.1
sssd-wbclient-devel - update to 1.16.1-150300.23.43.1
python3-sss-murmur - addressed in versions 1.16.1-150300.23.43.1, 2.5.2-150400.4.27.1, 2.5.2-150500.10.17.1
sssd-wbclient - update to 1.16.1-150300.23.43.1
python3-sss_nss_idmap - addressed in versions 1.16.1-150300.23.43.1, 2.5.2-150400.4.27.1, 2.5.2-150500.10.17.1
libnfsidmap-sss-debuginfo - addressed in versions 1.16.1-150300.23.43.1, 2.5.2-150400.4.27.1, 2.5.2-150500.10.17.1
sssd-wbclient-debuginfo - update to 1.16.1-150300.23.43.1
sssd-common-64bit-debuginfo - addressed in versions 1.16.1-150300.23.43.1, 2.5.2-150400.4.27.1, 2.5.2-150500.10.17.1
sssd-common-64bit - addressed in versions 1.16.1-150300.23.43.1, 2.5.2-150400.4.27.1, 2.5.2-150500.10.17.1
python3-ipa_hbac-debuginfo - addressed in versions 1.16.1-150300.23.43.1, 2.5.2-150400.4.27.1, 2.5.2-150500.10.17.1
python3-sss-murmur-debuginfo - addressed in versions 1.16.1-150300.23.43.1, 2.5.2-150400.4.27.1, 2.5.2-150500.10.17.1
sssd - update to 1.16.4-21.27
sssd-help - addressed in versions 2.2.2-16, 2.6.1-14
sssd-devel - addressed in versions 2.2.2-16, 2.6.1-14
sssd-debuginfo - addressed in versions 2.2.2-16, 2.6.1-14
python2-sssd - update to 2.2.2-16
sssd-debugsource - addressed in versions 2.2.2-16, 2.6.1-14
python3-sssd - addressed in versions 2.2.2-16, 2.6.1-14
sssd - addressed in versions 2.2.2-16, 2.6.1-14
sssd (Ubuntu package) - addressed in versions 2.2.3-3ubuntu0.13, 2.6.3-1ubuntu3.3, 2.9.1-2ubuntu2.1, 2.9.4-1.1ubuntu6.1
sssd-kcm - addressed in versions 2.5.2-150400.4.27.1, 2.5.2-150500.10.17.1
sssd-kcm-debuginfo - addressed in versions 2.5.2-150400.4.27.1, 2.5.2-150500.10.17.1
sssd (Red Hat package) - addressed in versions 2.6.2-4.el8_6.3, 2.8.2-4.el8_8.2, 2.8.2-5.el9_2.4, 2.9.4-3.el8_10, 2.9.4-6.el9_4
libsss_autofs (Red Hat package) - addressed in versions 2.6.2-4.el9_0.3, 2.8.2-5.el9_2.4
libsss_certmap (Red Hat package) - addressed in versions 2.6.2-4.el9_0.3, 2.8.2-5.el9_2.4
libipa_hbac (Red Hat package) - addressed in versions 2.6.2-4.el9_0.3, 2.8.2-5.el9_2.4
libsss_certmap-debuginfo (Red Hat package) - update to 2.8.2-5.el9_2.4
libsss_sudo-debuginfo (Red Hat package) - update to 2.8.2-5.el9_2.4
libsss_sudo (Red Hat package) - update to 2.8.2-5.el9_2.4
libsss_simpleifp-debuginfo (Red Hat package) - update to 2.8.2-5.el9_2.4
libsss_simpleifp (Red Hat package) - update to 2.8.2-5.el9_2.4
libsss_nss_idmap-debuginfo (Red Hat package) - update to 2.8.2-5.el9_2.4
libsss_nss_idmap (Red Hat package) - update to 2.8.2-5.el9_2.4
libsss_idmap-debuginfo (Red Hat package) - update to 2.8.2-5.el9_2.4
libsss_idmap (Red Hat package) - update to 2.8.2-5.el9_2.4
sssd-winbind-idmap-debuginfo (Red Hat package) - update to 2.8.2-5.el9_2.4
libsss_autofs-debuginfo (Red Hat package) - update to 2.8.2-5.el9_2.4
libipa_hbac-debuginfo (Red Hat package) - update to 2.8.2-5.el9_2.4
libsss_nss_idmap-devel (Red Hat package) - update to 2.8.2-5.el9_2.4
python3-libipa_hbac-debuginfo (Red Hat package) - update to 2.8.2-5.el9_2.4
python3-libsss_nss_idmap-debuginfo (Red Hat package) - update to 2.8.2-5.el9_2.4
sssd-tools-debuginfo (Red Hat package) - update to 2.8.2-5.el9_2.4
sssd-proxy-debuginfo (Red Hat package) - update to 2.8.2-5.el9_2.4
sssd-nfs-idmap-debuginfo (Red Hat package) - update to 2.8.2-5.el9_2.4
sssd-ldap-debuginfo (Red Hat package) - update to 2.8.2-5.el9_2.4
sssd-krb5-debuginfo (Red Hat package) - update to 2.8.2-5.el9_2.4
sssd-krb5-common-debuginfo (Red Hat package) - update to 2.8.2-5.el9_2.4
sssd-kcm-debuginfo (Red Hat package) - update to 2.8.2-5.el9_2.4
sssd-ipa-debuginfo (Red Hat package) - update to 2.8.2-5.el9_2.4
sssd-idp (Red Hat package) - update to 2.8.2-5.el9_2.4
sssd-debugsource (Red Hat package) - update to 2.8.2-5.el9_2.4
python3-sss-murmur (Red Hat package) - update to 2.8.2-5.el9_2.4
python3-sss (Red Hat package) - update to 2.8.2-5.el9_2.4
python3-libsss_nss_idmap (Red Hat package) - update to 2.8.2-5.el9_2.4
python3-libipa_hbac (Red Hat package) - update to 2.8.2-5.el9_2.4
sssd - update to 2.9.4-3
python3-sssdconfig - update to 2.9.4-3
sssd-ad - update to 2.9.4-3
sssd-client - update to 2.9.4-3
sssd-common - update to 2.9.4-3
sssd-common-pac - update to 2.9.4-3
sssd-dbus - update to 2.9.4-3
sssd-idp - update to 2.9.4-3
sssd-ipa - update to 2.9.4-3
sssd-kcm - update to 2.9.4-3
sssd-krb5 - update to 2.9.4-3
sssd-krb5-common - update to 2.9.4-3
sssd-ldap - update to 2.9.4-3
sssd-nfs-idmap - update to 2.9.4-3
sssd-polkit-rules - update to 2.9.4-3
sssd-proxy - update to 2.9.4-3
sssd-tools - update to 2.9.4-3
sssd-winbind-idmap - update to 2.9.4-3
python3-sss - update to 2.9.4-3
libipa_hbac - update to 2.9.4-3
libsss_autofs - update to 2.9.4-3
libsss_certmap - update to 2.9.4-3
libsss_idmap - update to 2.9.4-3
libsss_nss_idmap - update to 2.9.4-3
libsss_nss_idmap-devel - update to 2.9.4-3
libsss_simpleifp - update to 2.9.4-3
libsss_sudo - update to 2.9.4-3
python3-libipa_hbac - update to 2.9.4-3
python3-libsss_nss_idmap - update to 2.9.4-3
python3-sss-murmur - update to 2.9.4-3
Red Hat Ceph Storage - update to 5.3
IBM Qradar SIEM - update to 7.5.0 Update Pack 8 IF03
EMC Cloud Tiering Appliance - update to 13.2.0.2.29

External References

Related Security Bulletins