CVE-2024-56433
shadow-utils: Default subordinate ID configuration in /etc/login.defs could lead to compromise
Severity
LowRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · December 26, 2024
Updated · October 22, 2026
Description
A flaw was found in shadow-utils. Affected versions of shadow-utils establish a default /etc/subuid behavior, for example, uid 100000 through 165535 for the first user account, that can conflict with the uids of users defined on locally administered networks. This issue potentially leads to account takeover by leveraging newuidmap for access to an NFS home directory or same-host resources for remote logins by these local network users.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 3.6CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
CWE-1188 · Initialization of a Resource with an Insecure Default