CVE-2024-56433

What it actually does

Default subuid range allocation in shadow-utils (uid 100000-165535) can overlap with UIDs assigned on locally administered networks, allowing newuidmap to grant unintended access to files owned by those UIDs on NFS mounts or local resources.

Why it matters to the business

Organizations using shadow for user namespace mapping risk unauthorized access to shared storage or home directories when network-assigned UIDs collide with the default subuid range, potentially exposing sensitive data without requiring elevated privileges.

How an attack unfolds

An attacker with a UID matching the default subuid range logs in (remotely or locally), invokes newuidmap to map into the overlapping range, and gains read/write access to files owned by that UID on NFS home directories or equivalent resources.

How to fix it

Upgrade shadow-maint/shadow to commit 68061f2059124f5aa450dfbf6bbad3e7a6f65f9f or later; on Ubuntu 18.04 LTS upgrade ikiwiki to 3.20180228-1 or later. Manually adjust /etc/subuid ranges to avoid overlap with any locally administered network UID space and verify mappings after changes.

How to confirm the fix worked

Confirm package versions match or exceed the listed fixed releases, inspect /etc/subuid for non-overlapping ranges, and test newuidmap behavior with sample accounts whose UIDs sit near network-assigned values.

Typical attack path

1. Identify or control a user account whose UID falls inside the 100000-165535 subuid range
2. Trigger login or session that invokes newuidmap or subordinate UID mapping
3. Access NFS-mounted home directories or same-host resources belonging to the colliding UID
4. Read, modify, or exfiltrate data that should have been protected by UID separation

How to detect it

Review authentication and mapping logs for unexpected newuidmap invocations or UID mappings that align with the default 100000-165535 range; examine NFS access patterns for users whose UIDs fall inside that range.

What your security team should do

• Prioritize upgrade of shadow-utils on all systems using user namespaces or NFS home directories
• Audit existing /etc/subuid and /etc/subgid files for overlap with any known network UID ranges
• Document and enforce a site-wide policy for subuid allocation that excludes local network UID blocks
• Monitor EPSS trend and re-evaluate if exploit maturity increases