7.1

CVE-2023-3758

Exploit

Sssd: race condition during authorization leads to gpo policies functioning inconsistently

A race condition flaw was found in sssd where the GPO policy is not consistently applied for authenticated users. This may lead to improper authorization issues, granting or denying access to resources inappropriately.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Fedoraproject ≫ Sssd Version < 2.9.5
Redhat ≫ Codeready Linux Builder For Arm64 Version 8.0_aarch64
Redhat ≫ Virtualization Host Version 4.0
Redhat ≫ Enterprise Linux Version 8.0
Redhat ≫ Enterprise Linux Eus Version 8.6
Redhat ≫ Enterprise Linux Eus Version 8.8
Redhat ≫ Enterprise Linux Eus Version 9.0
Redhat ≫ Enterprise Linux Eus Version 9.2
Redhat ≫ Enterprise Linux Eus Version 9.4
Redhat ≫ Enterprise Linux Eus Version 9.6
Redhat ≫ Enterprise Linux For Arm 64 Version 8.0_aarch64
Redhat ≫ Enterprise Linux For Arm 64 Eus Version 8.6_aarch64
Redhat ≫ Enterprise Linux For Arm 64 Eus Version 8.8_aarch64
Redhat ≫ Enterprise Linux For Arm 64 Eus Version 9.0_aarch64
Redhat ≫ Enterprise Linux For Arm 64 Eus Version 9.2_aarch64
Redhat ≫ Enterprise Linux For Arm 64 Eus Version 9.4_aarch64
Redhat ≫ Enterprise Linux For Arm 64 Eus Version 9.6_aarch64
Fedoraproject ≫ Fedora Version 38
Fedoraproject ≫ Fedora Version 39
Fedoraproject ≫ Fedora Version 40
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.03% 0.593
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
CISA-ADP 7.1 1.2 5.9
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
RedHat 7.1 1.2 5.9
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

https://access.redhat.com/errata/RHSA-2024:1919
Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:1920
Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:1921
Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:1922
Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:2571
Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:3270
Third Party Advisory
https://access.redhat.com/security/cve/CVE-2023-3758
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2223762
Third Party Advisory
Issue Tracking
https://github.com/SSSD/sssd/pull/7302
Patch
Exploit
Issue Tracking
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RV3HIZI3SURBUQKSOOL3XE64OOBQ2HTK/
Third Party Advisory
Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XEP62IDS7A55D5UHM6GH7QZ7SQFOAPVF/
Third Party Advisory
Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XMORAO2BDDA5YX4ZLMXDZ7SM6KU47SY5/
Third Party Advisory
Mailing List
https://lists.debian.org/debian-lts-announce/2025/02/msg00008.html