Shadow-utils: possible password leak during passwd(1) change
Priority LOW 26CWE-303Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 8 fixed, 2 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-287.
Summary
A flaw was found in shadow-utils. When asking for a new password, shadow-utils asks the password twice. If the password fails on the second attempt, shadow-utils fails in cleaning the buffer used to store the first entry. This may allow an attacker with enough access to retrieve the password from the memory.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00256 17th percentileScored 2026-11-07
Fix Partial shadow-utils: 4.14.0-rc1Red Hat: 4 advisoriesRed Hat: 8 fixed, 2 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | shadow-utils | — | 4.14.0-rc1 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8 | — | 2:4.6-19.el8 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.6 Extended Update Support | — | 2:4.6-17.el8_6 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.8 Extended Update Support | — | 2:4.6-17.el8_8.2 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | 2:4.9-8.el9 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 6 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Enterprise Linux 7 | — | — | No fix listed | CNA |
- shadow-utils Vendor— Affected — Fixed in 4.14.0-rc1 Patch available CNA
- Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in 2:4.6-19.el8 Patch available CNA
- Red Hat Enterprise Linux 8.6 Extended Update Support VendorRed Hat Affected — Fixed in 2:4.6-17.el8_6 Patch available CNA
- Red Hat Enterprise Linux 8.8 Extended Update Support VendorRed Hat Affected — Fixed in 2:4.6-17.el8_8.2 Patch available CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 2:4.9-8.el9 Patch available CNA
- Red Hat Enterprise Linux 6 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Enterprise Linux 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
CPE configurations NVD · 17
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:shadow-maint:shadow-utils:*:*:*:*:*:*:*:* | before 4.14.0 | Vulnerable | shadow-maint |
| cpe:2.3:a:redhat:codeready_linux_builder:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:codeready_linux_builder:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:codeready_linux_builder_for_arm64:8.0_aarch64:*:*:*:*:*:*:* | 8.0_aarch64 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:codeready_linux_builder_for_arm64:9.0_aarch64:*:*:*:*:*:*:* | 9.0_aarch64 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems:8.0_s390x:*:*:*:*:*:*:* | 8.0_s390x | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems:9.0_s390x:*:*:*:*:*:*:* | 9.0_s390x | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian:8.0_ppc64le:*:*:*:*:*:*:* | 8.0_ppc64le | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian:9.0_ppc64le:*:*:*:*:*:*:* | 9.0_ppc64le | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Red Hat |
- cpe:2.3:a:shadow-maint:shadow-utils:*:*:*:*:*:*:*:* Versions before 4.14.0 Vulnerable ·shadow-maint
- cpe:2.3:a:redhat:codeready_linux_builder:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:codeready_linux_builder:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:codeready_linux_builder_for_arm64:8.0_aarch64:*:*:*:*:*:*:* Versions 8.0_aarch64 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:codeready_linux_builder_for_arm64:9.0_aarch64:*:*:*:*:*:*:* Versions 9.0_aarch64 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems:8.0_s390x:*:*:*:*:*:*:* Versions 8.0_s390x Vulnerable ·Red Hat
- cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems:9.0_s390x:*:*:*:*:*:*:* Versions 9.0_s390x Vulnerable ·Red Hat
- cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian:8.0_ppc64le:*:*:*:*:*:*:* Versions 8.0_ppc64le Vulnerable ·Red Hat
- cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian:9.0_ppc64le:*:*:*:*:*:*:* Versions 9.0_ppc64le Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
Show 7 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_for_arm_64:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_for_arm_64:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0_s390x:*:*:*:*:*:*:* | 8.0_s390x | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:9.0_s390x:*:*:*:*:*:*:* | 9.0_s390x | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0_ppc64le:*:*:*:*:*:*:* | 8.0_ppc64le | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:9.0_ppc64le:*:*:*:*:*:*:* | 9.0_ppc64le | Vulnerable | Red Hat |
- cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_for_arm_64:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_for_arm_64:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0_s390x:*:*:*:*:*:*:* Versions 8.0_s390x Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:9.0_s390x:*:*:*:*:*:*:* Versions 9.0_s390x Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0_ppc64le:*:*:*:*:*:*:* Versions 8.0_ppc64le Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:9.0_ppc64le:*:*:*:*:*:*:* Versions 9.0_ppc64le Vulnerable ·Red Hat
Remediation
- Fix · CNA shadow-utils Fixed in 4.14.0-rc1
Red Hat 4 advisories
- RHSA-2024:2577 Released 2024-04-30 · Red Hat rating Lowshadow-utils security update
- Red Hat CodeReady Linux Builder EUS (v.8.8) shadow-utils-subid-devel-2:4.6-17.el8_8.2
- Red Hat Enterprise Linux BaseOS EUS (v.8.8) shadow-utils-2:4.6-17.el8_8.2, shadow-utils-subid-2:4.6-17.el8_8.2
- RHSA-2024:0417 Released 2024-01-25 · Red Hat rating Lowshadow-utils security update
- Red Hat CodeReady Linux Builder EUS (v.8.6) shadow-utils-subid-devel-2:4.6-17.el8_6
- Red Hat Enterprise Linux BaseOS EUS (v.8.6) shadow-utils-2:4.6-17.el8_6, shadow-utils-subid-2:4.6-17.el8_6
- RHSA-2023:7112 Released 2023-11-14 · Red Hat rating Lowshadow-utils security and bug fix update
- Red Hat CodeReady Linux Builder (v. 8) shadow-utils-subid-devel-2:4.6-19.el8
- Red Hat Enterprise Linux BaseOS (v. 8) shadow-utils-2:4.6-19.el8, shadow-utils-subid-2:4.6-19.el8
Show 1 more Red Hat advisories
- RHSA-2023:6632 Released 2023-11-07 · Red Hat rating Lowshadow-utils security and bug fix update
- Red Hat CodeReady Linux Builder (v. 9) shadow-utils-subid-devel-2:4.9-8.el9
- Red Hat Enterprise Linux BaseOS (v. 9) shadow-utils-2:4.9-8.el9, shadow-utils-subid-2:4.9-8.el9
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat CodeReady Linux Builder (v. 8) | Fixed | RHSA-2023:7112 |
| Red Hat CodeReady Linux Builder (v. 9) | Fixed | RHSA-2023:6632 |
| Red Hat CodeReady Linux Builder EUS (v.8.6) | Fixed | RHSA-2024:0417 |
| Red Hat CodeReady Linux Builder EUS (v.8.8) | Fixed | RHSA-2024:2577 |
| Red Hat Enterprise Linux BaseOS (v. 8) | Fixed | RHSA-2023:7112 |
| Red Hat Enterprise Linux BaseOS (v. 9) | Fixed | RHSA-2023:6632 |
| Red Hat Enterprise Linux BaseOS EUS (v.8.6) | Fixed | RHSA-2024:0417 |
| Red Hat Enterprise Linux BaseOS EUS (v.8.8) | Fixed | RHSA-2024:2577 |
Timeline
- 2026-10-02 Threatist record created from CVE-2023-4641
- 2026-10-03 Alias added: GHSA-6ggv-mmg2-jf4r
References
More Red Hat Codeready Linux Builder vulnerabilities
- TI-2019-06284 Memory corruption in webkitgtk KEVCVSS 3.1HIGH 8.8
- TI-2023-04522 Glibc: buffer overflow in ld.so leading to privilege escalation KEVCVSS 3.1HIGH 7.8
- TI-2022-00753 A flaw was found in the way the "flags" member of the new pipe buffer structure was… KEVCVSS 3.1HIGH 7.8
- TI-2022-00413 Improper authentication in kernel KEVCVSS 3.1HIGH 7.8
- TI-2021-19843 Out-of-bounds read in Samba CVSS 3.1HIGH 8.8
- TI-2022-00359 Out-of-bounds write in kernel CVSS 3.1HIGH 8.8
Sources
- CVE-2023-4641 · CVE Program
- CVE-2023-4641 · NVD
- FIRST EPSS
- GHSA-6ggv-mmg2-jf4r · GitHub Advisory Database · CC BY 4.0
- CVE-2023-4641 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences