Skip to content
Fencer Vulns
low 3.3

CVE-2023-29383 json

In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn (change finger).

published 2023-04-14 3 y ago modified 2026-10-14 25 d ago also EUVD-2023-32955

cvss
3.3
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 37%
public exploits
0
none known

Summary

In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn (change finger). Although it is not possible to exploit this directly (e.g., adding a new user fails because \n is in the block list), it is possible to misrepresent the /etc/passwd file when viewed. Use of \r manipulations and Unicode characters to work around blocking of the : character make it possible to give the impression that a new user has been added. In other words, an adversary may be able to convince a system administrator to take the system offline (an indirect, social-engineered denial of service) by demonstrating that "cat /etc/passwd" shows a rogue user account.

Patch / fix

  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5
  • Siemens RUGGEDCOM ROX MX5000 V2.17.0
  • Siemens RUGGEDCOM ROX MX5000RE V2.17.0
  • Siemens RUGGEDCOM ROX RX1400 V2.17.0
  • Siemens RUGGEDCOM ROX RX1500 V2.17.0
  • Siemens RUGGEDCOM ROX RX1501 V2.17.0
  • Siemens RUGGEDCOM ROX RX1510 V2.17.0
  • Siemens RUGGEDCOM ROX RX1511 V2.17.0
  • Siemens RUGGEDCOM ROX RX1512 V2.17.0
  • Siemens RUGGEDCOM ROX RX1524 V2.17.0
  • Siemens RUGGEDCOM ROX RX1536 V2.17.0
  • Siemens RUGGEDCOM ROX RX5000 V2.17.0
  • shadow Debian 12 1:4.13+dfsg1-1+deb12u1
  • shadow Debian 14, Debian 13 1:4.13+dfsg1-2

debian advisories DEBIAN-CVE-2023-29383

  • shadow SLE Micro 5.5 4.8.1-150500.3.3.1
  • shadow SLE Micro 5.4, openSUSE Leap Micro 5.4 4.8.1-150400.3.6.1
  • shadow SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE Real Time 15 SP3 +7 more 4.8.1-150300.4.6.1
  • shadow SLES for SAP 12 SP4, SLES 12 SP4-LTSS, SLES 12 SP4-ESPOS +3 more 4.2.1-27.22.1
  • shadow SLES for SAP 15 SP2, SLES for SAP 15 SP1, SLES 15 SP2-LTSS +4 more 4.6-150100.3.8.1
  • shadow SLES for SAP 12 SP5, SLES 12 SP5 4.2.1-36.3.1
  • shadow SLE Module for Basesystem 15 SP4, SLE Micro 5.3, openSUSE Leap Micro 5.3 +1 more 4.8.1-150400.10.6.1

suse advisories SUSE-SU-2024:1007-1SUSE-SU-2024:1007-2SUSE-SU-2024:0939-1SUSE-SU-2023:2070-1SUSE-SU-2023:2069-1SUSE-SU-2023:2068-1

  • shadow openSUSE Tumbleweed 4.13-6.1

opensuse advisories openSUSE-SU-2024:12881-1

  • shadow Alpine 3.18 4.13-r3
  • shadow Alpine 3.24, Alpine 3.23, Alpine 3.22 +3 more 4.13-r4

alpine advisories ALPINE-CVE-2023-29383

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • shadow-utils CBL-Mariner 2.0 4.9-13

azure linux advisories AZL-26247

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-29383 updated cvss 5.5

shadow: Improper input validation in shadow-utils package utility chfn

  • Red Hat Enterprise Linux 6 shadow-utils Red Hat Enterprise Linux 7 uuidd, libuuid, libblkid, libmount, util-linux, shadow-utils Red Hat Enterprise Linux 8 uuidd, libuuid, libblkid, libfdisk, libmount, util-linux, +5 more Red Hat Enterprise Linux 9 uuidd, libuuid, libblkid, libfdisk, libmount, util-linux, +6 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-23-348-10 updated cvss 3.3

Siemens SIMATIC S7-1500

  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) >= 3.1.0, < 3.1.5 Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) >= 3.1.0, < 3.1.5
    affected: fixed in V3.1.5, mitigation support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
partial
Assessed
21 mo ago

Exploit prediction

0.43% chance of exploitation in the next 30 days, higher than 37% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • trustwave.com https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=31797 referenced PoC, tagged "exploit" by a source, unverified
  • trustwave.com https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/cve-2023-29383-abusing-linux-chfn-to-misrepresent-etc-passwd/ referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Affected products

  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP
  • Siemens RUGGEDCOM ROX MX5000
  • Siemens RUGGEDCOM ROX MX5000RE
  • Siemens RUGGEDCOM ROX RX1400
  • Siemens RUGGEDCOM ROX RX1500
  • Siemens RUGGEDCOM ROX RX1501
  • Siemens RUGGEDCOM ROX RX1510
  • Siemens RUGGEDCOM ROX RX1511
  • Siemens RUGGEDCOM ROX RX1512
  • Siemens RUGGEDCOM ROX RX1524
  • Siemens RUGGEDCOM ROX RX1536
  • Siemens RUGGEDCOM ROX RX5000

Classification

Weakness
  • CWE-125 Out-of-bounds Read
  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.