CVE-2018-7169: Medium severity Shadow Project Shadow vulnerability
An issue was discovered in shadow 4.5. newgidmap (in shadow-utils) is setuid and allows an unprivileged user to be placed in a user namespace where setgroups(2) is permitted. This allows an attacker to remove themselves from a supplementary group, which may allow access to certain filesystem paths if the administrator has used "group blacklisting" (e.g., chmod g-rwx) to restrict access to paths. This flaw effectively reverts a security feature in the kernel (in particular, the /proc/self/setgroups knob) to prevent this sort of privilege escalation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
shadowto a version that resolves this vulnerability.Fixed in 4.5 - Configuration
Prevent unprivileged setuid use of newgidmap in shadow-utils by removing/avoiding setuid permissions on newgidmap, since it is described as setuid and enabling an unprivileged user to place themselves in a user namespace where setgroups(2) is permitted.
shadow-utils (newgidmap) setuid = disabled - Compensating control
Mitigate the risk by ensuring the /proc/self/setgroups knob is not reverted (i.e., the kernel setting that restricts setgroups in user namespaces remains enforced) to prevent privilege escalation via supplementary group removal.
Event History
Frequently Asked Questions
What is the severity of CVE-2018-7169?
CVE-2018-7169 has a medium severity rating due to its potential to grant unauthorized access to filesystem paths.
How do I fix CVE-2018-7169?
To fix CVE-2018-7169, update the shadow package to version 4.5 or later, which addresses the vulnerability.
Who is affected by CVE-2018-7169?
CVE-2018-7169 affects systems running the shadow package version 4.5.
What is the impact of CVE-2018-7169 on systems?
The impact of CVE-2018-7169 allows an unprivileged user to remove themselves from a supplementary group, potentially leading to unauthorized access.
Is CVE-2018-7169 easy to exploit?
CVE-2018-7169 can be exploited by users with minimal privileges, making it a relatively low-barrier attack.