CVE-2023-3758
Assigner: redhat
Published: 2024-04-18T19:06:44.216Z
State: PUBLISHED
title: Sssd: race condition during authorization leads to gpo policies functioning inconsistently
metrics: other: content: value: Moderate
namespace: https://access.redhat.com/security/updates/classification/
type: Red Hat severity rating
cvssV3_1: attackComplexity: HIGH
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
format: CVSS
descriptions: value: A race condition flaw was found in sssd where the GPO policy is not consistently applied for authenticated users. This may lead to improper authorization issues, granting or denying access to resources inappropriately.
affected: vendor: Red Hat
product: Red Hat Enterprise Linux 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: sssd
defaultStatus: affected
versions: version: 0:2.9.4-3.el8_10
lessThan: *
versionType: rpm
status: unaffected
cpes: cpe:/o:redhat:enterprise_linux:8::baseos
cpe:/a:redhat:enterprise_linux:8::appstream
cpe:/a:redhat:enterprise_linux:8::crb
vendor: Red Hat
product: Red Hat Enterprise Linux 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: sssd
defaultStatus: affected
versions: version: 0:2.9.4-3.el8_10
lessThan: *
versionType: rpm
status: unaffected
cpes: cpe:/o:redhat:enterprise_linux:8::baseos
cpe:/a:redhat:enterprise_linux:8::appstream
cpe:/a:redhat:enterprise_linux:8::crb
vendor: Red Hat
product: Red Hat Enterprise Linux 8.6 Extended Update Support
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: sssd
defaultStatus: affected
versions: version: 0:2.6.2-4.el8_6.3
lessThan: *
versionType: rpm
status: unaffected
cpes: cpe:/o:redhat:rhel_eus:8.6::baseos
cpe:/o:redhat:rhev_hypervisor:4.4::el8
cpe:/a:redhat:rhel_eus:8.6::crb
vendor: Red Hat
product: Red Hat Enterprise Linux 8.8 Extended Update Support
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: sssd
defaultStatus: affected
versions: version: 0:2.8.2-4.el8_8.2
lessThan: *
versionType: rpm
status: unaffected
cpes: cpe:/a:redhat:rhel_eus:8.8::appstream
cpe:/a:redhat:rhel_eus:8.8::crb
cpe:/o:redhat:rhel_eus:8.8::baseos
vendor: Red Hat
product: Red Hat Enterprise Linux 9
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: sssd
defaultStatus: affected
versions: version: 0:2.9.4-6.el9_4
lessThan: *
versionType: rpm
status: unaffected
cpes: cpe:/a:redhat:enterprise_linux:9::crb
cpe:/a:redhat:enterprise_linux:9::appstream
cpe:/o:redhat:enterprise_linux:9::baseos
vendor: Red Hat
product: Red Hat Enterprise Linux 9
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: sssd
defaultStatus: affected
versions: version: 0:2.9.4-6.el9_4
lessThan: *
versionType: rpm
status: unaffected
cpes: cpe:/a:redhat:enterprise_linux:9::crb
cpe:/a:redhat:enterprise_linux:9::appstream
cpe:/o:redhat:enterprise_linux:9::baseos
vendor: Red Hat
product: Red Hat Enterprise Linux 9.0 Extended Update Support
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: sssd
defaultStatus: affected
versions: version: 0:2.6.2-4.el9_0.3
lessThan: *
versionType: rpm
status: unaffected
cpes: cpe:/o:redhat:rhel_eus:9.0::baseos
cpe:/a:redhat:rhel_eus:9.0::crb
vendor: Red Hat
product: Red Hat Enterprise Linux 9.2 Extended Update Support
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: sssd
defaultStatus: affected
versions: version: 0:2.8.2-5.el9_2.4
lessThan: *
versionType: rpm
status: unaffected
cpes: cpe:/o:redhat:rhel_eus:9.2::baseos
cpe:/a:redhat:rhel_eus:9.2::crb
cpe:/a:redhat:rhel_eus:9.2::appstream
vendor: Red Hat
product: Red Hat Virtualization 4 for Red Hat Enterprise Linux 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: sssd
defaultStatus: affected
versions: version: 0:2.6.2-4.el8_6.3
lessThan: *
versionType: rpm
status: unaffected
cpes: cpe:/o:redhat:rhel_eus:8.6::baseos
cpe:/o:redhat:rhev_hypervisor:4.4::el8
cpe:/a:redhat:rhel_eus:8.6::crb
vendor: Red Hat
product: Red Hat Enterprise Linux 6
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: sssd
defaultStatus: unknown
cpes: cpe:/o:redhat:enterprise_linux:6
vendor: Red Hat
product: Red Hat Enterprise Linux 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: sssd
defaultStatus: unknown
cpes: cpe:/o:redhat:enterprise_linux:7
datePublic: 2024-04-16T00:00:00+00:00
problemTypes: descriptions: cweId: CWE-285
description: Improper Authorization
type: CWE
x_redhatCweChain: CWE-362->CWE-285: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') leads to Improper Authorization
workarounds: value: A mitigation can be applied to the sssd.conf file that would make the occurrence of the race condition more difficult:

1. Increase the GPO cache time out editing the following configuration directive in sssd.conf file:
    a) ad_gpo_cache_timeout = 3600
    Ps.: This value (3600) should make the cache time out in one hour but would make GPO updates propagation from AD server to local machines take longer.

[1] https://access.redhat.com/documentation/pt-br/red_hat_enterprise_linux/7/html/windows_integration_guide/sssd-gpo
timeline: time: 2023-07-14T00:00:00+00:00
value: Reported to Red Hat.
time: 2024-04-16T00:00:00+00:00
value: Made public.