CVE-2023-4641: Shadow-utils: possible password leak during passwd(1) change

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-12-27 · updated 2026-06-17
Weakness: CWE-303

Description

A flaw was found in shadow-utils. When asking for a new password, shadow-utils asks the password twice. If the password fails on the second attempt, shadow-utils fails in cleaning the buffer used to store the first entry. This may allow an attacker with enough access to retrieve the password from the memory.

Affected products

RedHat Codeready Linux Builder: 8.0, 9.0
RedHat Codeready Linux Builder For Arm64: 8.0_aarch64, 9.0_aarch64
RedHat Codeready Linux Builder For Ibm Z Systems: 8.0_s390x, 9.0_s390x
RedHat Codeready Linux Builder For Power Little Endian: 8.0_ppc64le, 9.0_ppc64le
Red Hat Enterprise Linux: 8.0, 9.0
RedHat Enterprise Linux For Arm 64: 8.0, 9.0
RedHat Enterprise Linux For Ibm Z Systems: 8.0_s390x, 9.0_s390x
RedHat Enterprise Linux For Power Little Endian: 8.0_ppc64le, 9.0_ppc64le
shadow-maint shadow-utils: before 4.14.0 — fixed in 4.14.0

How to fix

Upgrade to a fixed version: shadow-maint shadow-utils 4.14.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-4641 or the next vulnerability affects your stack