CVE-2016-6252

What it actually does

Integer overflow in shadow 4.2.1 newuidmap allows local users to gain privileges via crafted input.

Why it matters to the business

Local attackers can obtain elevated privileges on affected systems, risking full host compromise for services such as oauth2-proxy; low exploit prevalence reduces immediate urgency but still requires patching.

How an attack unfolds

A local attacker supplies specially crafted input to the newuidmap utility, triggering an integer overflow that results in privilege escalation.

How to fix it

Upgrade oauth2-proxy (Chainguard) and oauth2-proxy (Wolfi) to 7.6.0-r6 or later.

How to confirm the fix worked

Confirm oauth2-proxy package version is 7.6.0-r6 or newer via package manager queries and verify absence of vulnerable shadow 4.2.1 components.

Typical attack path

1. Obtain local shell access
2. Locate and invoke the vulnerable newuidmap binary
3. Supply crafted input to trigger integer overflow
4. Escalate to higher privileges

How to detect it

Review local process execution logs and audit trails for invocations of newuidmap with anomalous arguments or unexpected privilege transitions.

What your security team should do

• Apply the 7.6.0-r6 update to all affected oauth2-proxy deployments
• Review local user access controls and limit unnecessary uid mapping capabilities
• Scan systems for any remaining instances of shadow 4.2.1