CVE-2023-4641 Shadow-utils: possible password leak during passwd(1) change
An attacker with sufficient access can retrieve a user's password from memory if the second password entry attempt fails during a passwd change.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-4641?
CVE-2023-4641 is a medium-severity vulnerability in Redhat Enterprise Linux, published on 27 Dec 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A flaw was found in shadow-utils. When asking for a new password, shadow-utils asks the password twice. If the password fails on the second attempt, shadow-utils fails in cleaning the buffer used to store the first entry. This may allow an attacker with enough access to retrieve the password from the memory.
Which versions are affected by CVE-2023-4641?
It affects 9 products.
Linux distribution packages (40)
shadow-utils AlmaLinux:8 | All versions | 2:4.6-19.el8 |
shadow-utils-subid AlmaLinux:8 | All versions | 2:4.6-19.el8 |
shadow-utils-subid-devel AlmaLinux:8 | All versions | 2:4.6-19.el8 |
shadow-utils AlmaLinux:9 | All versions | 2:4.9-8.el9 |
shadow-utils-subid AlmaLinux:9 | All versions | 2:4.9-8.el9 |
shadow-utils-subid-devel AlmaLinux:9 | All versions | 2:4.9-8.el9 |
shadow-utils Red Hat:enterprise_linux:8::baseos | All versions | 2:4.6-19.el8 |
shadow-utils-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 2:4.6-19.el8 |
shadow-utils-debugsource Red Hat:enterprise_linux:8::baseos | All versions | 2:4.6-19.el8 |
shadow-utils-subid Red Hat:enterprise_linux:8::baseos | All versions | 2:4.6-19.el8 |
shadow-utils-subid-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 2:4.6-19.el8 |
shadow-utils-debuginfo Red Hat:enterprise_linux:8::crb | All versions | 2:4.6-19.el8 |
shadow-utils-debugsource Red Hat:enterprise_linux:8::crb | All versions | 2:4.6-19.el8 |
shadow-utils-subid-debuginfo Red Hat:enterprise_linux:8::crb | All versions | 2:4.6-19.el8 |
shadow-utils-subid-devel Red Hat:enterprise_linux:8::crb | All versions | 2:4.6-19.el8 |
shadow-utils Red Hat:enterprise_linux:9::baseos | All versions | 2:4.9-8.el9 |
shadow-utils-debuginfo Red Hat:enterprise_linux:9::baseos | All versions | 2:4.9-8.el9 |
shadow-utils-debugsource Red Hat:enterprise_linux:9::baseos | All versions | 2:4.9-8.el9 |
shadow-utils-subid Red Hat:enterprise_linux:9::baseos | All versions | 2:4.9-8.el9 |
shadow-utils-subid-debuginfo Red Hat:enterprise_linux:9::baseos | All versions | 2:4.9-8.el9 |
shadow-utils-debuginfo Red Hat:enterprise_linux:9::crb | All versions | 2:4.9-8.el9 |
shadow-utils-debugsource Red Hat:enterprise_linux:9::crb | All versions | 2:4.9-8.el9 |
shadow-utils-subid-debuginfo Red Hat:enterprise_linux:9::crb | All versions | 2:4.9-8.el9 |
shadow-utils-subid-devel Red Hat:enterprise_linux:9::crb | All versions | 2:4.9-8.el9 |
shadow-utils Red Hat:rhel_eus:8.6::baseos | All versions | 2:4.6-17.el8_6 |
shadow-utils-debuginfo Red Hat:rhel_eus:8.6::baseos | All versions | 2:4.6-17.el8_6 |
shadow-utils-debugsource Red Hat:rhel_eus:8.6::baseos | All versions | 2:4.6-17.el8_6 |
shadow-utils-subid Red Hat:rhel_eus:8.6::baseos | All versions | 2:4.6-17.el8_6 |
shadow-utils-subid-debuginfo Red Hat:rhel_eus:8.6::baseos | All versions | 2:4.6-17.el8_6 |
shadow-utils-debuginfo Red Hat:rhel_eus:8.6::crb | All versions | 2:4.6-17.el8_6 |
shadow-utils-debugsource Red Hat:rhel_eus:8.6::crb | All versions | 2:4.6-17.el8_6 |
shadow-utils-subid-debuginfo Red Hat:rhel_eus:8.6::crb | All versions | 2:4.6-17.el8_6 |
shadow-utils-subid-devel Red Hat:rhel_eus:8.6::crb | All versions | 2:4.6-17.el8_6 |
shadow-utils Red Hat:rhel_eus:8.8::baseos | All versions | 2:4.6-17.el8_8.2 |
shadow-utils-debuginfo Red Hat:rhel_eus:8.8::baseos | All versions | 2:4.6-17.el8_8.2 |
shadow-utils-debugsource Red Hat:rhel_eus:8.8::baseos | All versions | 2:4.6-17.el8_8.2 |
shadow-utils-subid Red Hat:rhel_eus:8.8::baseos | All versions | 2:4.6-17.el8_8.2 |
shadow-utils-subid-debuginfo Red Hat:rhel_eus:8.8::baseos | All versions | 2:4.6-17.el8_8.2 |
shadow-utils-debuginfo Red Hat:rhel_eus:8.8::crb | All versions | 2:4.6-17.el8_8.2 |
shadow-utils-debugsource Red Hat:rhel_eus:8.8::crb | All versions | 2:4.6-17.el8_8.2 |
Products include Redhat Codeready Linux Builder, Redhat Codeready Linux Builder for Arm64, Redhat Codeready Linux Builder for Ibm Z Systems, Redhat Codeready Linux Builder for Power Little Endian, Redhat Enterprise Linux, Redhat Enterprise Linux for Arm 64 and 3 more.
How do I fix CVE-2023-4641?
Apply the vendor's patch.
Is CVE-2023-4641 being exploited?
There is no known exploitation of CVE-2023-4641 in the wild and no public exploit code.
Other vulnerabilities in Redhat Enterprise Linux
Sources
Also known as ALSA-2023:6632, ALSA-2023:7112, AZL-32253, BELL-CVE-2023-4641, CLSA-2024-1719246768, CLSA-2026-1779267466 and 19 more.