{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:canonical:authd:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A2665677-2BEF-4230-AF87-5C0530CF7193",
              "versionEndExcluding": "0.3.6",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Authd, through version 0.3.6, did not sufficiently randomize user IDs to prevent collisions. A local attacker who can register user names could spoof another user\u0027s ID and gain their privileges."
    },
    {
      "lang": "es",
      "value": "Authd, hasta la versi\u00f3n 0.3.6, no aleatorizaba lo suficiente los identificadores de usuario para evitar colisiones. Un atacante local que pudiera registrar nombres de usuario podr\u00eda falsificar el identificador de otro usuario y obtener sus privilegios."
    }
  ],
  "id": "CVE-2024-9312",
  "lastModified": "2025-08-26T17:43:11.117",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 0.8,
        "impactScore": 6.0,
        "source": "security@ubuntu.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 6.4,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 0.5,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2024-10-10T14:15:05.863",
  "references": [
    {
      "source": "security@ubuntu.com",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://github.com/ubuntu/authd/security/advisories/GHSA-4gfw-wf7c-w6g2"
    },
    {
      "source": "security@ubuntu.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-9312"
    }
  ],
  "sourceIdentifier": "security@ubuntu.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-286"
        }
      ],
      "source": "security@ubuntu.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-335"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/ubuntu/authd"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "0.0.0-20230706090440-d8cb2d561419"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-9312"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-286"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-10-10T16:43:58Z",
    "nvd_published_at": "2024-10-10T14:15:05Z",
    "severity": "MODERATE"
  },
  "details": "CVE description:\n\nAuthd, through version 0.3.6, did not sufficiently randomize user IDs to prevent collisions. A local attacker who can register user names could spoof another user\u0027s ID and gain their privileges.\n\n\n----- original report -----\n# Cause\nauthd assigns user IDs as a pure function of the user name. Moreover, the set of UIDs is much too small for pseudo-random assignment to work: the birthday bound predicts random collisions will occur with probability 50% after only 54 562 IDs were assigned.\n\n`authd` only checks for uniqueness [within its local cache](https://github.com/ubuntu/authd/blob/4946962aa4ac6e5b7d2b53503026659581c73907/internal/users/cache/update.go#L67-L71), which\n- may be inconsistent across multiple systems within the same domain ;\n- may be purged, due to being stored in `/var/cache` ;\n- automatically removes entries of users who have not logged into that specific system within the last 6 months.\n\nThe current `GenerateID` method, authored in September 2024 (commit a6c85ed24b8d17a2d11c859e8d70f5a52fa69690),\nrepeatedly hashes the user name until the 4 leading bytes fall into the interval [60 000; 2\u00b3\u00b9[ :\nhttps://github.com/ubuntu/authd/blob/f9f851540e6377fca18a45ce7a02d024c1dbd6e9/internal/users/manager.go#L425\nhttps://github.com/ubuntu/authd/blob/f9f851540e6377fca18a45ce7a02d024c1dbd6e9/internal/services/nss/nss.go#L188\n\nPrevious versions are affected by similar issues, though without the use of a cryptographic hash in `GenerateID`, making exploitation computationally-easier.\n\n\n# Impact\n\nSince GenerateID is a pure function with no secret input, and the set of UIDs is small, an adversary which can register users with chosen names can\n- register multiple users with colliding IDs, or\n- register a single user whose ID collides with a target user\u0027s, whether one managed by `authd`, or a system user whose well-known ID is in a range which [overlaps `authd`\u0027s].\n\nIn the latter case, as all access control performed by the Linux kernel (and other Unices\u0027 kernels) is based on IDs and not usernames, if the attacker can sign into a system, they will have the same privileges as the target user.  The attacker can bypass the uniqueness check in (at least) the following ways:\n- engineer a situation where the system administrator purges `/var/cache` ;\n- target a system account [whose UID is in `authd`\u0027s range](https://github.com/ubuntu/authd/issues/547) ;\n- target an account which hasn\u0027t logged into a specific system in more than 6 months.\n  Note that this isn\u0027t limited to inactive accounts *within the entire domain*, and impersonation on a given system can potentially be leveraged to compromise the target account on other systems; for example:\n  - user `alice` is known to log into `1.example.com` ;\n  - the attacker computes a preimage (a username which yields the same UID), let\u0027s call it `bob` ;\n  - the attacker creates the account `bob` and logs into `2.example.com`, succeeding if alice hasn\u0027t (recently) logged into that system ;\n  - the attacker can now manipulate resources exposed on `2` as if they were alice; assuming `/home` is shared, they could manipulate `~alice/.ssh/authorized_keys`, `~alice/.config`, alice\u0027s shell\u0027s initialization file, etc.\n    Note: NFSv4\u0027s `idmap` mechanism may prevent this, but isn\u0027t enabled by default (unless Kerberos is used, which isn\u0027t the case in an `authd` deployment)\n  - at that point, gaining code execution as alice on `1.example.com` is usually trivial.\n\nSince the necessary computation can be performed entirely offline, this wouldn\u0027t be affected by any rate-limits, and the only audit trail would be a single user registration. This would require on average less than 2\u00b3\u00b9 computations of `GenerateID`: assuming SHA-256\u0027s cost is 25 cycles-per-byte, a clock speed of 3GHz, and short (\u226432B) generated usernames, this is less than 10 minutes of a single core\u0027s time.\n\n[overlaps `authd`\u0027s]: https://github.com/ubuntu/authd/issues/547\n\n# Remediation\n\nThe simplest and likely-best remediation path would be for the external IdP to provide a guaranteed-unique user ID in the correct range.\nIn OIDC, this is commonly communicated through a claim, though its name would need to be configurable as there\u0027s no real standard:\n- CERN uses `cern_person_id`: https://auth.docs.cern.ch/user-documentation/oidc/config/ ;\n- Okta, Zitadel, and many other IdPs, require the realm\u0027s administrator to define a custom attribute, conventionally called `uid` or `uidNumber` ;\n- etc.\n\nThis is also supported by other commonplace identity providers, such as LDAP and Active Directory:\nhttps://learn.microsoft.com/en-us/windows/win32/adschema/a-uidNumber\n\nMS Entra presumably supports this as well.\n\n\nIf that is not possible for some reason, architectural changes to authd would likely be required:\nassigning user IDs from a small space (such as Linux\u0027s 32b UIDs) requires mutable state to ensure uniqueness, whereas authd\u0027s design currently assumes no mutable state is held, aside from some transient, local cache.\nMoreover, that mutable state may need to be synchronised across multiple machines as uniform UIDs are often necessary, for instance when accessing a common networked filesystem.\n\n\n# Acknowledgements\n\nThanks to Michael Gebetsroither for assisting with the writeup, and Jamie Bliss for the same as well as investigating when the issue was introduced in authd.",
  "id": "GHSA-4gfw-wf7c-w6g2",
  "modified": "2024-10-10T16:43:58Z",
  "published": "2024-10-10T16:43:58Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/ubuntu/authd/security/advisories/GHSA-4gfw-wf7c-w6g2"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9312"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ubuntu/authd"
    },
    {
      "type": "WEB",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-9312"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Authd allows attacker-controlled usernames to yield controllable UIDs"
}