CVE-2023-29383 is a low-severity vulnerability affecting Shadow 4.13, allowing control character injection into fields processed by the SUID chfn program. While direct exploitation for creating new users is prevented, an attacker can manipulate the display of the /etc/passwd file using carriage returns and Unicode characters to falsely suggest a rogue user account exists. This could lead to a social-engineered denial of service if a system administrator is convinced to take the system offline. There is no known active exploitation, publicly available exploit code, or significant community discussion surrounding this vulnerability.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
4.13CPE matchmatch criteria | cpe:2.3:a:shadow_project:shadow:4.13:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
shadow: Improper input validation in shadow-utils package utility chfn
Apr 15, 2023In Shadow 4.13 it is possible to inject control characters into fields provided to the SUID program chfn (change finger). Although it is not possible to exploit this directly (e.g. adding a new user fails because \n is in the block list) it is possible to misrepresent the /etc/passwd file when viewed. Use of \r manipulations and Unicode characters to work around blocking of the : character make it possible to give the impression that a new user has been added. In other words an adversary may be able to convince a system administrator to take the system offline (an indirect social-engineered denial of service) by demonstrating that "cat /etc/passwd" shows a rogue user account.
Apr 11, 2023