CVE-2025-14104: Util-linux: util-linux: heap buffer overread in setpwnam() when processing 256-byte usernames
A flaw was found in util-linux. Heap buffer overread when processing 256-byte usernames. Affects any SUID login-utils utility writing to password database. The setpwnam() function allocates a 256-byte buffer but accesses linebuf[256] when username length equals 256, causing a heap buffer overread.
Other sources
A flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the setpwnam() function, affecting SUID (Set User ID) login-utils utilities writing to the password database.
— NVD
Util-linux: util-linux: heap buffer overread in setpwnam() when processing 256-byte usernames
— Microsoft
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-14104?
CVE-2025-14104 is classified as a high severity vulnerability due to potential heap buffer overreads affecting system security.
How do I fix CVE-2025-14104?
To fix CVE-2025-14104, update to the latest version of util-linux that addresses this vulnerability.
What versions of util-linux are affected by CVE-2025-14104?
CVE-2025-14104 affects all versions of util-linux that utilize the setpwnam() function with SUID login-utils.
What kind of attack can be performed using CVE-2025-14104?
An attacker may exploit CVE-2025-14104 to cause a denial of service or potentially gain unauthorized access to sensitive information.
Is CVE-2025-14104 exploitable remotely?
Yes, CVE-2025-14104 can be exploited remotely if an attacker can control username inputs processed by SUID login-utils.