CVE-2024-56433

LowCVSS 3.6/10Last modified Oct 15, 2026

Description

shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users). NOTE: it may also be argued that system administrators should not have assigned uids, within local networks, that are within the range that can occur in /etc/subuid.

Metrics

CVSS 3.1 3.6/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-1188

Affected software

No affected versions have been published.

Timeline

Published
Dec 26, 2024
Last modified
Oct 15, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-564347.5UAF vulnerability in the device node access module Impact: Successful exploitation of this vulnerability may cause service exceptions of theCVE-2024-564357.5Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service CVE-2024-564367.5Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service CVE-2024-564377.5Vulnerability of input parameters not being verified in the widget framework module Impact: Successful exploitation of this vulnerability maCVE-2024-564387.5Vulnerability of improper memory address protection in the HUKS module Impact: Successful exploitation of this vulnerability may affect avaiCVE-2024-564397.5Access control vulnerability in the identity authentication module Impact: Successful exploitation of this vulnerability may affect service CVE-2024-56445.4The Tournamatch WordPress plugin before 4.6.1 does not sanitise and escape some of its settings, which could allow high privilege users suchCVE-2024-564407.5Permission control vulnerability in the Connectivity module Impact: Successful exploitation of this vulnerability may cause features to perfCVE-2024-564415.9Race condition vulnerability in the Bastet module Impact: Successful exploitation of this vulnerability may affect service confidentiality.CVE-2024-564427.5Vulnerability of native APIs not being implemented in the NFC service module Impact: Successful exploitation of this vulnerability may causeCVE-2024-564437.5Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service CVE-2024-564447.5Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service
CVE-2024-56433: Low severity, CVSS 3.6 | Vulnix