USN-6640-1: shadow vulnerability
Published Feb 15, 2024
·Updated
It was discovered that shadow was not properly sanitizing memory when running the password utility. An attacker could possibly use this issue to retrieve a password from memory, exposing sensitive information.
Affected Software
40 affected componentsFixes available
All of the following
ubuntu/libsubid-dev<1:4.13+dfsg1-1ubuntu1.1
1:4.13+dfsg1-1ubuntu1.1
Ubuntu Ubuntu=23.10
All of the following
ubuntu/libsubid4<1:4.13+dfsg1-1ubuntu1.1
1:4.13+dfsg1-1ubuntu1.1
Ubuntu Ubuntu=23.10
All of the following
ubuntu/login<1:4.13+dfsg1-1ubuntu1.1
1:4.13+dfsg1-1ubuntu1.1
Ubuntu Ubuntu=23.10
All of the following
ubuntu/passwd<1:4.13+dfsg1-1ubuntu1.1
1:4.13+dfsg1-1ubuntu1.1
Ubuntu Ubuntu=23.10
All of the following
ubuntu/uidmap<1:4.13+dfsg1-1ubuntu1.1
1:4.13+dfsg1-1ubuntu1.1
Ubuntu Ubuntu=23.10
All of the following
ubuntu/login<1:4.8.1-2ubuntu2.2
1:4.8.1-2ubuntu2.2
Ubuntu Ubuntu=22.04
All of the following
ubuntu/passwd<1:4.8.1-2ubuntu2.2
1:4.8.1-2ubuntu2.2
Ubuntu Ubuntu=22.04
All of the following
ubuntu/uidmap<1:4.8.1-2ubuntu2.2
1:4.8.1-2ubuntu2.2
Ubuntu Ubuntu=22.04
All of the following
ubuntu/login<1:4.8.1-1ubuntu5.20.04.5
1:4.8.1-1ubuntu5.20.04.5
Ubuntu Ubuntu=20.04
All of the following
ubuntu/passwd<1:4.8.1-1ubuntu5.20.04.5
1:4.8.1-1ubuntu5.20.04.5
Ubuntu Ubuntu=20.04
All of the following
ubuntu/uidmap<1:4.8.1-1ubuntu5.20.04.5
1:4.8.1-1ubuntu5.20.04.5
Ubuntu Ubuntu=20.04
All of the following
ubuntu/login<1:4.5-1ubuntu2.5+esm1
1:4.5-1ubuntu2.5+esm1
Ubuntu Ubuntu=18.04
All of the following
ubuntu/passwd<1:4.5-1ubuntu2.5+esm1
1:4.5-1ubuntu2.5+esm1
Ubuntu Ubuntu=18.04
All of the following
ubuntu/uidmap<1:4.5-1ubuntu2.5+esm1
1:4.5-1ubuntu2.5+esm1
Ubuntu Ubuntu=18.04
All of the following
ubuntu/login<1:4.2-3.1ubuntu5.5+esm4
1:4.2-3.1ubuntu5.5+esm4
Ubuntu Ubuntu=16.04
All of the following
ubuntu/passwd<1:4.2-3.1ubuntu5.5+esm4
1:4.2-3.1ubuntu5.5+esm4
Ubuntu Ubuntu=16.04
All of the following
ubuntu/uidmap<1:4.2-3.1ubuntu5.5+esm4
1:4.2-3.1ubuntu5.5+esm4
Ubuntu Ubuntu=16.04
All of the following
ubuntu/login<1:4.1.5.1-1ubuntu9.5+esm4
1:4.1.5.1-1ubuntu9.5+esm4
Ubuntu Ubuntu=14.04
All of the following
ubuntu/passwd<1:4.1.5.1-1ubuntu9.5+esm4
1:4.1.5.1-1ubuntu9.5+esm4
Ubuntu Ubuntu=14.04
All of the following
ubuntu/uidmap<1:4.1.5.1-1ubuntu9.5+esm4
1:4.1.5.1-1ubuntu9.5+esm4
Ubuntu Ubuntu=14.04
Event History
Feb 15, 2024
Advisory Published
via Ubuntu·12:00 AM
Frequently Asked Questions
1
What is the severity of USN-6640-1?
The severity of USN-6640-1 is classified as a high risk due to the potential for sensitive information exposure.
2
How do I fix USN-6640-1?
To fix USN-6640-1, update the affected packages to the latest version provided by your Ubuntu distribution.
3
Which Ubuntu versions are affected by USN-6640-1?
USN-6640-1 affects Ubuntu versions 23.10, 22.04, 20.04, 18.04, 16.04, and 14.04.
4
What packages are impacted by USN-6640-1?
USN-6640-1 impacts the packages libsubid-dev, libsubid4, login, passwd, and uidmap.
5
What kind of vulnerability is described in USN-6640-1?
USN-6640-1 describes a memory sanitization vulnerability that may allow attackers to retrieve passwords from memory.