CVE-2024-56433 Privilege escalation in shadow-utils
Default subuid ranges in shadow-utils can conflict with local network UIDs, allowing attackers to escalate privileges or take over accounts via NFS or remote logins.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-56433?
CVE-2024-56433 is a low-severity vulnerability in shadow-maint shadow-utils, published on 26 Dec 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users). NOTE: it may also be argued that system administrators should not have assigned uids, within local networks, that are within the range that can occur in /etc/subuid.
Weakness: CWE-1188
Which versions are affected by CVE-2024-56433?
Linux distribution packages (23)
shadow-utils AlmaLinux:10 | All versions | 2:4.15.0-8.el10 |
shadow-utils-subid AlmaLinux:10 | All versions | 2:4.15.0-8.el10 |
shadow-utils-subid-devel AlmaLinux:10 | All versions | 2:4.15.0-8.el10 |
shadow-utils AlmaLinux:9 | All versions | 2:4.9-15.el9 |
shadow-utils-subid AlmaLinux:9 | All versions | 2:4.9-15.el9 |
shadow-utils-subid-devel AlmaLinux:9 | All versions | 2:4.9-15.el9 |
shadow-utils Red Hat:enterprise_linux:10.1 | All versions | 2:4.15.0-8.el10 |
shadow-utils-debuginfo Red Hat:enterprise_linux:10.1 | All versions | 2:4.15.0-8.el10 |
shadow-utils-debugsource Red Hat:enterprise_linux:10.1 | All versions | 2:4.15.0-8.el10 |
shadow-utils-subid Red Hat:enterprise_linux:10.1 | All versions | 2:4.15.0-8.el10 |
shadow-utils-subid-debuginfo Red Hat:enterprise_linux:10.1 | All versions | 2:4.15.0-8.el10 |
shadow-utils-subid-devel Red Hat:enterprise_linux:10.1 | All versions | 2:4.15.0-8.el10 |
shadow-utils Red Hat:enterprise_linux:9::baseos | All versions | 2:4.9-15.el9 |
shadow-utils-debuginfo Red Hat:enterprise_linux:9::baseos | All versions | 2:4.9-15.el9 |
shadow-utils-debugsource Red Hat:enterprise_linux:9::baseos | All versions | 2:4.9-15.el9 |
shadow-utils-subid Red Hat:enterprise_linux:9::baseos | All versions | 2:4.9-15.el9 |
shadow-utils-subid-debuginfo Red Hat:enterprise_linux:9::baseos | All versions | 2:4.9-15.el9 |
shadow-utils-debuginfo Red Hat:enterprise_linux:9::crb | All versions | 2:4.9-15.el9 |
shadow-utils-debugsource Red Hat:enterprise_linux:9::crb | All versions | 2:4.9-15.el9 |
shadow-utils-subid-debuginfo Red Hat:enterprise_linux:9::crb | All versions | 2:4.9-15.el9 |
shadow-utils-subid-devel Red Hat:enterprise_linux:9::crb | All versions | 2:4.9-15.el9 |
shadow-utils Rocky Linux:10 | All versions | 2:4.15.0-8.el10 |
shadow-utils Rocky Linux:9 | All versions | 2:4.9-15.el9 |
How do I fix CVE-2024-56433?
Apply the vendor's patch.
Is CVE-2024-56433 being exploited?
There is no known exploitation of CVE-2024-56433 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as ALSA-2025:20145, ALSA-2025:20559, AZL-54674, BELL-CVE-2024-56433, DEBIAN-CVE-2024-56433, GHSA-7683-vm2j-m4cc and 5 more.