CVE-2023-3758 Sssd: race condition during authorization leads to gpo policies functioning inconsistently
A race condition in SSSD causes inconsistent GPO policy application, potentially allowing improper access to resources.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-3758?
CVE-2023-3758 is a high-severity vulnerability in Fedoraproject Fedora, published on 18 Apr 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A race condition flaw was found in sssd where the GPO policy is not consistently applied for authenticated users. This may lead to improper authorization issues, granting or denying access to resources inappropriately.
Weakness: CWE-362
Which versions are affected by CVE-2023-3758?
It affects 23 products.
Linux distribution packages (40)
libipa_hbac AlmaLinux:8 | All versions | 2.9.4-3.el8_10 |
libsss_autofs AlmaLinux:8 | All versions | 2.9.4-3.el8_10 |
libsss_certmap AlmaLinux:8 | All versions | 2.9.4-3.el8_10 |
libsss_idmap AlmaLinux:8 | All versions | 2.9.4-3.el8_10 |
libsss_nss_idmap AlmaLinux:8 | All versions | 2.9.4-3.el8_10 |
libsss_nss_idmap-devel AlmaLinux:8 | All versions | 2.9.4-3.el8_10 |
libsss_simpleifp AlmaLinux:8 | All versions | 2.9.4-3.el8_10 |
libsss_sudo AlmaLinux:8 | All versions | 2.9.4-3.el8_10 |
python3-libipa_hbac AlmaLinux:8 | All versions | 2.9.4-3.el8_10 |
python3-libsss_nss_idmap AlmaLinux:8 | All versions | 2.9.4-3.el8_10 |
python3-sss AlmaLinux:8 | All versions | 2.9.4-3.el8_10 |
python3-sss-murmur AlmaLinux:8 | All versions | 2.9.4-3.el8_10 |
python3-sssdconfig AlmaLinux:8 | All versions | 2.9.4-3.el8_10 |
sssd AlmaLinux:8 | All versions | 2.9.4-3.el8_10 |
sssd-ad AlmaLinux:8 | All versions | 2.9.4-3.el8_10 |
sssd-client AlmaLinux:8 | All versions | 2.9.4-3.el8_10 |
sssd-common AlmaLinux:8 | All versions | 2.9.4-3.el8_10 |
sssd-common-pac AlmaLinux:8 | All versions | 2.9.4-3.el8_10 |
sssd-dbus AlmaLinux:8 | All versions | 2.9.4-3.el8_10 |
sssd-idp AlmaLinux:8 | All versions | 2.9.4-3.el8_10 |
sssd-ipa AlmaLinux:8 | All versions | 2.9.4-3.el8_10 |
sssd-kcm AlmaLinux:8 | All versions | 2.9.4-3.el8_10 |
sssd-krb5 AlmaLinux:8 | All versions | 2.9.4-3.el8_10 |
sssd-krb5-common AlmaLinux:8 | All versions | 2.9.4-3.el8_10 |
sssd-ldap AlmaLinux:8 | All versions | 2.9.4-3.el8_10 |
sssd-nfs-idmap AlmaLinux:8 | All versions | 2.9.4-3.el8_10 |
sssd-polkit-rules AlmaLinux:8 | All versions | 2.9.4-3.el8_10 |
sssd-proxy AlmaLinux:8 | All versions | 2.9.4-3.el8_10 |
sssd-tools AlmaLinux:8 | All versions | 2.9.4-3.el8_10 |
sssd-winbind-idmap AlmaLinux:8 | All versions | 2.9.4-3.el8_10 |
libipa_hbac AlmaLinux:9 | All versions | 2.9.4-6.el9_4 |
libsss_autofs AlmaLinux:9 | All versions | 2.9.4-6.el9_4 |
libsss_certmap AlmaLinux:9 | All versions | 2.9.4-6.el9_4 |
libsss_idmap AlmaLinux:9 | All versions | 2.9.4-6.el9_4 |
libsss_nss_idmap AlmaLinux:9 | All versions | 2.9.4-6.el9_4 |
libsss_nss_idmap-devel AlmaLinux:9 | All versions | 2.9.4-6.el9_4 |
libsss_simpleifp AlmaLinux:9 | All versions | 2.9.4-6.el9_4 |
libsss_sudo AlmaLinux:9 | All versions | 2.9.4-6.el9_4 |
python3-libipa_hbac AlmaLinux:9 | All versions | 2.9.4-6.el9_4 |
python3-libsss_nss_idmap AlmaLinux:9 | All versions | 2.9.4-6.el9_4 |
Products include Fedoraproject Fedora, Fedoraproject Sssd, Redhat Codeready Linux Builder, Redhat Codeready Linux Builder Eus, Redhat Codeready Linux Builder for Arm64, Redhat Codeready Linux Builder for Arm64 Eus and 17 more.
How do I fix CVE-2023-3758?
Apply the vendor's patch.
Is CVE-2023-3758 being exploited?
There is no known exploitation of CVE-2023-3758 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as ALSA-2024:2571, ALSA-2024:3270, CLSA-2025-1748945377, CLSA-2025-1748947069, CLSA-2025-1748967240, CLSA-2025-1751143797 and 23 more.