CVE-2024-56433

Publication date 26 December 2024

Last updated 11 July 2025

Ubuntu priority

Low

Why this priority?

Cvss 3 Severity Score

3.6 · Low

Score breakdown

shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users). NOTE: it may also be argued that system administrators should not have assigned uids, within local networks, that are within the range that can occur in /etc/subuid.

Read the notes from the security team

Why is this CVE low priority?

Needs administrator to have assigned conflicting UIDs

Learn more about Ubuntu priority

Status

Package Ubuntu Release Status
shadow 25.04 plucky
Vulnerable, fix deferred
24.10 oracular Ignored end of life, was deferred [2025-03-17]
24.04 LTS noble
Vulnerable, fix deferred
22.04 LTS jammy
Vulnerable, fix deferred
20.04 LTS focal
Vulnerable, fix deferred
18.04 LTS bionic
Vulnerable, fix deferred
16.04 LTS xenial
Vulnerable, fix deferred
14.04 LTS trusty
Vulnerable, fix deferred

Notes

mdeslaur

as of 2025-03-17, there is no upstream fix for this issue

Severity score breakdown

Parameter Value
Base score 3.6 · Low
Attack vector Local
Attack complexity High
Privileges required Low
User interaction None
Scope Unchanged
Confidentiality Low
Integrity impact Low
Availability impact None
Vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N