CVE-2023-4641: Shadow-utils: possible password leak during passwd(1) change
A flaw was found in shadow-utils. When asking for a new password, shadow-utils asks the password twice. If the password fails on the second attempt, shadow-utils fails in cleaning the buffer used to store the first entry. This may allow an attacker with enough access to retrieve the password from the memory.
Other sources
shadow-maint shadow-utils could allow a local authenticated attacker to obtain sensitive information, caused by failing to clean the buffer used to store password information. By sending a specially crafted request, an attacker could exploit this vulnerability to obtain password information, and use this information to launch further attacks against the affected system.
— IBM
When gpasswd(1) asks for the new password, it asks twice (as is usual for confirming the new password). Each of those 2 password prompts uses agetpass() to get the password. If the second agetpass() fails, the first password, which has been copied into the 'static' buffer 'pass' via STRFCPY(), wasn't being zeroed.
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-4641?
CVE-2023-4641 is classified as a medium severity vulnerability.
How do I fix CVE-2023-4641?
To fix CVE-2023-4641, update shadow-utils to version 1:4.13+dfsg1-4 or higher.
What impact does CVE-2023-4641 have on affected systems?
CVE-2023-4641 can potentially allow attackers to retrieve sensitive passwords from memory.
Which versions of shadow-utils are affected by CVE-2023-4641?
Versions of shadow-utils up to 4.14.0 are affected by CVE-2023-4641.
What operating systems are impacted by CVE-2023-4641?
CVE-2023-4641 affects multiple versions of Debian and Ubuntu operating systems.