CVE-2024-9312
published 2024-10-10CVE-2024-9312: Authd, through version 0.3.6, did not sufficiently randomize user IDs to prevent collisions. A local attacker who can register user names could spoof another…
PriorityP429medium6.4CVSS 3.1
AVLACHPRHUINSUCHIHAH
EPSS
0.28%
19.9th percentile
Authd, through version 0.3.6, did not sufficiently randomize user IDs to prevent collisions. A local attacker who can register user names could spoof another user's ID and gain their privileges.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | authd | < 0.3.6 | 0.3.6 |
| canonical_ltd | authd | < 0.3.6 | 0.3.6 |
| github.com | ubuntu_authd | >= 0 < 0.3.6 | 0.3.6 |
| github.com | ubuntu_authd | 0 – 0.0.0-20230706090440-d8cb2d561419 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Authd allows attacker-controlled usernames to yield controllable UIDs in github.com/ubuntu/authd
osv·2024-10-11
CVE-2024-9312 Authd allows attacker-controlled usernames to yield controllable UIDs in github.com/ubuntu/authd
Authd allows attacker-controlled usernames to yield controllable UIDs in github.com/ubuntu/authd
Authd allows attacker-controlled usernames to yield controllable UIDs in github.com/ubuntu/authd
GHSA
Authd allows attacker-controlled usernames to yield controllable UIDs
ghsa·2024-10-10
CVE-2024-9312 [MEDIUM] CWE-286 Authd allows attacker-controlled usernames to yield controllable UIDs
Authd allows attacker-controlled usernames to yield controllable UIDs
CVE description:
Authd, through version 0.3.6, did not sufficiently randomize user IDs to prevent collisions. A local attacker who can register user names could spoof another user's ID and gain their privileges.
----- original report -----
# Cause
authd assigns user IDs as a pure function of the user name. Moreover, the set of UIDs is much too small for pseudo-random assignment to work: the birthday bound predicts random collisions will occur with probability 50% after only 54 562 IDs were assigned.
`authd` only checks for uniqueness [within its local cache](https://github.com/ubuntu/authd/blob/4946962aa4ac6e5b7d2b53503026659581c73907/internal/users/cache/update.go#L67-L71), which
- may be inconsistent across multip
OSV
Authd allows attacker-controlled usernames to yield controllable UIDs
osv·2024-10-10
CVE-2024-9312 [MEDIUM] Authd allows attacker-controlled usernames to yield controllable UIDs
Authd allows attacker-controlled usernames to yield controllable UIDs
CVE description:
Authd, through version 0.3.6, did not sufficiently randomize user IDs to prevent collisions. A local attacker who can register user names could spoof another user's ID and gain their privileges.
----- original report -----
# Cause
authd assigns user IDs as a pure function of the user name. Moreover, the set of UIDs is much too small for pseudo-random assignment to work: the birthday bound predicts random collisions will occur with probability 50% after only 54 562 IDs were assigned.
`authd` only checks for uniqueness [within its local cache](https://github.com/ubuntu/authd/blob/4946962aa4ac6e5b7d2b53503026659581c73907/internal/users/cache/update.go#L67-L71), which
- may be inconsistent across multip
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-10-10
Published