7.1

CVE-2023-3758

Exploit

A race condition flaw was found in sssd where the GPO policy is not consistently applied for authenticated users. This may lead to improper authorization issues, granting or denying access to resources inappropriately.

Data is provided by the National Vulnerability Database (NVD)
Fedoraproject ≫ Sssd Version < 2.9.5
Redhat ≫ Codeready Linux Builder For Arm64 Version8.0_aarch64
Redhat ≫ Virtualization Host Version4.0
Redhat ≫ Enterprise Linux Version8.0
Redhat ≫ Enterprise Linux Eus Version8.6
Redhat ≫ Enterprise Linux Eus Version8.8
Redhat ≫ Enterprise Linux Eus Version9.0
Redhat ≫ Enterprise Linux Eus Version9.2
Redhat ≫ Enterprise Linux Eus Version9.4
Redhat ≫ Enterprise Linux Eus Version9.6
Redhat ≫ Enterprise Linux For Arm 64 Version8.0_aarch64
Redhat ≫ Enterprise Linux For Arm 64 Eus Version8.6_aarch64
Redhat ≫ Enterprise Linux For Arm 64 Eus Version8.8_aarch64
Redhat ≫ Enterprise Linux For Arm 64 Eus Version9.0_aarch64
Redhat ≫ Enterprise Linux For Arm 64 Eus Version9.2_aarch64
Redhat ≫ Enterprise Linux For Arm 64 Eus Version9.4_aarch64
Redhat ≫ Enterprise Linux For Arm 64 Eus Version9.6_aarch64
Fedoraproject ≫ Fedora Version38
Fedoraproject ≫ Fedora Version39
Fedoraproject ≫ Fedora Version40
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.03% 0.077
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
134c704f-9b21-4f2e-91b3-4a467353bcc0 7.1 1.2 5.9
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
secalert@redhat.com 7.1 1.2 5.9
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

https://bugzilla.redhat.com/show_bug.cgi?id=2223762
Third Party Advisory
Issue Tracking
https://github.com/SSSD/sssd/pull/7302
Patch
Exploit
Issue Tracking