Bug 2334165 (CVE-2024-56433) - CVE-2024-56433 shadow-utils: Default subordinate ID configuration in /etc/login.defs could lead to compromise
Summary: CVE-2024-56433 shadow-utils: Default subordinate ID configuration in /etc/log...
Keywords:
Status: NEW
Alias: CVE-2024-56433
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2334168 2334169
Blocks:
TreeView+ depends on / blocked
 
Reported: 2024-12-26 09:01 UTC by OSIDB Bzimport
Modified: 2025-11-11 11:18 UTC (History)
7 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github shadow-maint shadow issues 1157 0 None open Default subordinate ID configuration in /etc/login.defs could lead to compromise 2025-07-23 19:06:10 UTC
Red Hat Product Errata RHSA-2025:20145 0 None None None 2025-11-11 09:09:53 UTC
Red Hat Product Errata RHSA-2025:20559 0 None None None 2025-11-11 11:18:24 UTC

Description OSIDB Bzimport 2024-12-26 09:01:18 UTC
shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users). NOTE: it may also be argued that system administrators should not have assigned uids, within local networks, that are within the range that can occur in /etc/subuid.

Comment 2 Colin Walters 2025-07-23 17:32:29 UTC
This breaks effectively all realistic default usage of podman rootless containers for new installs (or new users in existing installs), which is a pretty large impact.

As is it would mean everyone who wants to do that would need to ensure their provisioned systems re add the uid ranges.

We have the inverse problem too in that applying this update won’t actually fix the problem if somehow existing uids do overlap!

Really I think the deliverable for this CVE should probably be a tool that can be run to analyze/adjust if there is actually a clash, not just disable the functionality globally by default.

Comment 3 Adam Williamson 2025-07-23 18:36:54 UTC
yeah, breaking podman out of the box is pretty bad. It broke some openQA tests, and I just found my way here trying to figure out why.

Comment 4 Adam Williamson 2025-07-23 19:06:10 UTC
Dug into this and found some discussion, particularly at https://github.com/shadow-maint/shadow/issues/1157 .

I think the relatively 'low' range 100000 through 165535 was specifically chosen to avoid conflict with FreeIPA, which 'reserves' a range of 200000 IPs on install. By default it does this to pick the start of the range:

random.randint(1, 10000) * 200000

which means it will never start lower than 200000, but it might use *any* UID above 200000. However, this makes a conflict much more likely with a large non-FreeIPA site, if it just started at 1000 and counted up, or whatever - that seems to be the situation the reporter of the github issue found themselves in.

Comment 5 Joel Capitao 2025-07-23 19:40:53 UTC
FYI there is a broader discussion going on at https://bugzilla.redhat.com/show_bug.cgi?id=2382662

Comment 6 errata-xmlrpc 2025-11-11 09:09:51 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2025:20145 https://access.redhat.com/errata/RHSA-2025:20145

Comment 7 errata-xmlrpc 2025-11-11 11:18:23 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2025:20559 https://access.redhat.com/errata/RHSA-2025:20559


Note You need to log in before you can comment on or make changes to this bug.