CVE-2023-3758 json
Sssd: race condition during authorization leads to gpo policies functioning inconsistently
published 2024-04-18 2 y ago modified 2026-11-07 44 h ago also EUVD-2023-44393
- cvss
- 7.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.0%
- EPSS 1.0% chance of exploitation in 30 days, percentile 64%
- public exploits
- 0
- none known
Summary
A race condition flaw was found in sssd where the GPO policy is not consistently applied for authenticated users. This may lead to improper authorization issues, granting or denying access to resources inappropriately.
Patch / fix
- Red Hat Red Hat Enterprise Linux 8 0:2.9.4-3.el8_10
- Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support 0:2.6.2-4.el8_6.3
- Red Hat Red Hat Enterprise Linux 8.8 Extended Update Support 0:2.8.2-4.el8_8.2
- Red Hat Red Hat Enterprise Linux 9 0:2.9.4-6.el9_4
- Red Hat Red Hat Enterprise Linux 9.0 Extended Update Support 0:2.6.2-4.el9_0.3
- Red Hat Red Hat Enterprise Linux 9.2 Extended Update Support 0:2.8.2-5.el9_2.4
- Red Hat Red Hat Virtualization 4 for Red Hat Enterprise Linux 8 0:2.6.2-4.el8_6.3
- sssd Debian 12 2.8.2-4+deb12u1
- sssd Debian 14, Debian 13 2.9.5-1
debian advisories DEBIAN-CVE-2023-3758
- sssd Ubuntu 20.04 LTS 2.2.3-3ubuntu0.13
- sssd Ubuntu 22.04 LTS 2.6.3-1ubuntu3.3
- sssd Ubuntu 24.04 LTS 2.9.4-1.1ubuntu6.1
ubuntu advisories UBUNTU-CVE-2023-3758
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- sssd RHEL 8 2.9.4-3.el8_10
- sssd-ad RHEL 8 2.9.4-3.el8_10
- sssd-idp RHEL 8 2.9.4-3.el8_10
- sssd-ipa RHEL 8 2.9.4-3.el8_10
- sssd-kcm RHEL 8 2.9.4-3.el8_10
- sssd-dbus RHEL 8 2.9.4-3.el8_10
- sssd-krb5 RHEL 8 2.9.4-3.el8_10
- sssd-ldap RHEL 8 2.9.4-3.el8_10
red hat advisories RHSA-2024:3270RHSA-2024:2571RHSA-2024:1920RHSA-2024:1922RHSA-2024:1921RHSA-2024:1919
- sssd Linux Micro 6.0 2.8.2-6.1
- sssd SLE Module for Basesystem 15 SP6, openSUSE Leap 15.6 2.9.3-150600.3.3.1
- sssd SLE Module for Basesystem 15 SP5, SLE Micro 5.5, openSUSE Leap 15.5 2.5.2-150500.10.17.1
- sssd SLES for SAP 15 SP4, SLES 15 SP4-LTSS, SLE Micro 5.4 +7 more 2.5.2-150400.4.27.1
- sssd SLES for SAP 12 SP5, SLES 12 SP5, SLE Software Development Kit 12 SP5 1.16.1-7.61.1
- sssd SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE Micro 5.2 +3 more 1.16.1-150300.23.43.1
- sssd SLES for SAP 15 SP2, SLES 15 SP2-LTSS, SLE High Performance Computing 15 SP2-LTSS 1.16.1-150200.17.32.1
suse advisories SUSE-SU-2025:20131-1SUSE-SU-2024:1941-1SUSE-SU-2024:1579-1SUSE-SU-2024:1578-1SUSE-SU-2024:1577-1SUSE-SU-2024:1563-1
- sssd AlmaLinux 8 2.9.4-3.el8_10
- sssd-ad AlmaLinux 8 2.9.4-3.el8_10
- sssd-idp AlmaLinux 8 2.9.4-3.el8_10
- sssd-ipa AlmaLinux 8 2.9.4-3.el8_10
- sssd-kcm AlmaLinux 8 2.9.4-3.el8_10
- sssd-dbus AlmaLinux 8 2.9.4-3.el8_10
- sssd-krb5 AlmaLinux 8 2.9.4-3.el8_10
- sssd-ldap AlmaLinux 8 2.9.4-3.el8_10
almalinux advisories ALSA-2024:3270ALSA-2024:2571
- sssd Rocky Linux 8 2.9.4-3.el8_10
- sssd Rocky Linux 9 2.9.4-6.el9_4
rocky linux advisories RLSA-2024:3270RLSA-2024:2571
- github.com/SSSD/sssd#7302 pull request
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2023-3758 updated cvss 7.1
sssd: Race condition during authorization leads to GPO policies functioning inconsistently
-
Red Hat Enterprise Linux 6 sssd, sssd-ad, sssd-ipa, sssd-dbus, sssd-krb5, sssd-ldap, +19 more Red Hat Enterprise Linux 7 sssd, sssd-ad, sssd-ipa, sssd-kcm, sssd-dbus, sssd-krb5, +24 moreaffected: workaround, no fix planned “Out of support scope”
-
Red Hat CodeReady Linux Builder EUS (v.8.6) sssd-debuginfo 2.6.2-4.el8_6.3, sssd-debugsource 2.6.2-4.el8_6.3, sssd-ad-debuginfo 2.6.2-4.el8_6.3, sssd-ipa-debuginfo 2.6.2-4.el8_6.3, sssd-kcm-debuginfo 2.6.2-4.el8_6.3, sssd-dbus-debuginfo 2.6.2-4.el8_6.3, +22 morefixed: vendor fix RHSA-2024:1921
-
Red Hat CodeReady Linux Builder EUS (v.8.8) sssd-debuginfo 2.8.2-4.el8_8.2, sssd-debugsource 2.8.2-4.el8_8.2, sssd-ad-debuginfo 2.8.2-4.el8_8.2, sssd-idp-debuginfo 2.8.2-4.el8_8.2, sssd-ipa-debuginfo 2.8.2-4.el8_8.2, sssd-kcm-debuginfo 2.8.2-4.el8_8.2, +23 morefixed: vendor fix RHSA-2024:1922
-
Red Hat CodeReady Linux Builder EUS (v.9.0) sssd-debuginfo 2.6.2-4.el9_0.3, sssd-debugsource 2.6.2-4.el9_0.3, sssd-ad-debuginfo 2.6.2-4.el9_0.3, sssd-ipa-debuginfo 2.6.2-4.el9_0.3, sssd-kcm-debuginfo 2.6.2-4.el9_0.3, sssd-dbus-debuginfo 2.6.2-4.el9_0.3, +22 morefixed: vendor fix RHSA-2024:1919
-
Red Hat CodeReady Linux Builder EUS (v.9.2) sssd-debuginfo 2.8.2-5.el9_2.4, sssd-debugsource 2.8.2-5.el9_2.4, sssd-ad-debuginfo 2.8.2-5.el9_2.4, sssd-idp-debuginfo 2.8.2-5.el9_2.4, sssd-ipa-debuginfo 2.8.2-5.el9_2.4, sssd-kcm-debuginfo 2.8.2-5.el9_2.4, +23 morefixed: vendor fix RHSA-2024:1920
-
Red Hat Enterprise Linux AppStream (v. 8) sssd-idp 2.9.4-3.el8_10fixed: vendor fix RHSA-2024:3270
-
Red Hat Enterprise Linux AppStream (v. 9) sssd-idp 2.9.4-6.el9_4fixed: vendor fix RHSA-2024:2571
-
Red Hat Enterprise Linux AppStream EUS (v.8.8) sssd-idp 2.8.2-4.el8_8.2fixed: vendor fix RHSA-2024:1922
show 10 moreshow fewer
-
Red Hat Enterprise Linux AppStream EUS (v.9.2) sssd-idp 2.8.2-5.el9_2.4fixed: vendor fix RHSA-2024:1920
-
Red Hat Enterprise Linux BaseOS (v. 8) sssd 2.9.4-3.el8_10, sssd-ad 2.9.4-3.el8_10, sssd-ipa 2.9.4-3.el8_10, sssd-kcm 2.9.4-3.el8_10, sssd-dbus 2.9.4-3.el8_10, sssd-krb5 2.9.4-3.el8_10, +22 morefixed: vendor fix RHSA-2024:3270
-
Red Hat Enterprise Linux BaseOS (v. 9) sssd 2.9.4-6.el9_4, sssd-ad 2.9.4-6.el9_4, sssd-ipa 2.9.4-6.el9_4, sssd-kcm 2.9.4-6.el9_4, sssd-dbus 2.9.4-6.el9_4, sssd-krb5 2.9.4-6.el9_4, +23 morefixed: vendor fix RHSA-2024:2571
-
Red Hat Enterprise Linux BaseOS EUS (v.8.6) sssd 2.6.2-4.el8_6.3, sssd-ad 2.6.2-4.el8_6.3, sssd-ipa 2.6.2-4.el8_6.3, sssd-kcm 2.6.2-4.el8_6.3, sssd-dbus 2.6.2-4.el8_6.3, sssd-krb5 2.6.2-4.el8_6.3, +22 morefixed: vendor fix RHSA-2024:1921
-
Red Hat Enterprise Linux BaseOS EUS (v.8.8) sssd 2.8.2-4.el8_8.2, sssd-ad 2.8.2-4.el8_8.2, sssd-ipa 2.8.2-4.el8_8.2, sssd-kcm 2.8.2-4.el8_8.2, sssd-dbus 2.8.2-4.el8_8.2, sssd-krb5 2.8.2-4.el8_8.2, +22 morefixed: vendor fix RHSA-2024:1922
-
Red Hat Enterprise Linux BaseOS EUS (v.9.0) sssd 2.6.2-4.el9_0.3, sssd-ad 2.6.2-4.el9_0.3, sssd-ipa 2.6.2-4.el9_0.3, sssd-kcm 2.6.2-4.el9_0.3, sssd-dbus 2.6.2-4.el9_0.3, sssd-krb5 2.6.2-4.el9_0.3, +22 morefixed: vendor fix RHSA-2024:1919
-
Red Hat Enterprise Linux BaseOS EUS (v.9.2) sssd 2.8.2-5.el9_2.4, sssd-ad 2.8.2-5.el9_2.4, sssd-ipa 2.8.2-5.el9_2.4, sssd-kcm 2.8.2-5.el9_2.4, sssd-dbus 2.8.2-5.el9_2.4, sssd-krb5 2.8.2-5.el9_2.4, +22 morefixed: vendor fix RHSA-2024:1920
-
Red Hat Enterprise Linux CRB (v. 8) sssd-debuginfo 2.9.4-3.el8_10, sssd-debugsource 2.9.4-3.el8_10, sssd-ad-debuginfo 2.9.4-3.el8_10, sssd-idp-debuginfo 2.9.4-3.el8_10, sssd-ipa-debuginfo 2.9.4-3.el8_10, sssd-kcm-debuginfo 2.9.4-3.el8_10, +23 morefixed: vendor fix RHSA-2024:3270
-
Red Hat Enterprise Linux CRB (v. 9) sssd-debuginfo 2.9.4-6.el9_4, sssd-debugsource 2.9.4-6.el9_4, sssd-ad-debuginfo 2.9.4-6.el9_4, sssd-idp-debuginfo 2.9.4-6.el9_4, sssd-ipa-debuginfo 2.9.4-6.el9_4, sssd-kcm-debuginfo 2.9.4-6.el9_4, +24 morefixed: vendor fix RHSA-2024:2571
-
Red Hat Virtualization 4 Hypervisor for RHEL 8 sssd 2.6.2-4.el8_6.3, sssd-ad 2.6.2-4.el8_6.3, sssd-ipa 2.6.2-4.el8_6.3, sssd-kcm 2.6.2-4.el8_6.3, sssd-dbus 2.6.2-4.el8_6.3, sssd-krb5 2.6.2-4.el8_6.3, +22 morefixed: vendor fix RHSA-2024:1921
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 21 mo ago
Exploit prediction
1.04% chance of exploitation in the next 30 days, higher than 64% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/SSSD/sssd/pull/7302 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.1 | CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
| CISA ADP | 3.1 | 7.1 | CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected products
- Red Hat Red Hat Enterprise Linux 8
- Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support
- Red Hat Red Hat Enterprise Linux 8.8 Extended Update Support
- Red Hat Red Hat Enterprise Linux 9
- Red Hat Red Hat Enterprise Linux 9.0 Extended Update Support
- Red Hat Red Hat Enterprise Linux 9.2 Extended Update Support
- Red Hat Red Hat Virtualization 4 for Red Hat Enterprise Linux 8
- Red Hat Red Hat Enterprise Linux 6
- Red Hat Red Hat Enterprise Linux 7
Classification
- Weakness
-
- CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization
References
-
github.com
/SSSD/sssd/pull/7302
exploit, issue-tracking, patch
-
access.redhat.com
/errata/RHSA-2024:1919
vendor-advisory, third-party-advisory
-
access.redhat.com
/errata/RHSA-2024:1920
vendor-advisory, third-party-advisory
-
access.redhat.com
/errata/RHSA-2024:1921
vendor-advisory, third-party-advisory
-
access.redhat.com
/errata/RHSA-2024:1922
vendor-advisory, third-party-advisory
-
access.redhat.com
/errata/RHSA-2024:2571
vendor-advisory, third-party-advisory
-
access.redhat.com
/errata/RHSA-2024:3270
vendor-advisory, third-party-advisory
-
access.redhat.com
/security/cve/CVE-2023-3758
vdb-entry, third-party-advisory
-
bugzilla.redhat.com
/show_bug.cgi?id=2223762
issue-tracking, third-party-advisory
-
lists.fedoraproject.org
/archives/list/package-announce@lists.fedoraproject.org/message/RV3HIZI3SURBUQKSOOL3XE64OOBQ2HTK/
mailing-list, third-party-advisory
-
lists.fedoraproject.org
/archives/list/package-announce@lists.fedoraproject.org/message/XEP62IDS7A55D5UHM6GH7QZ7SQFOAPVF/
mailing-list, third-party-advisory
-
lists.fedoraproject.org
/archives/list/package-announce@lists.fedoraproject.org/message/XMORAO2BDDA5YX4ZLMXDZ7SM6KU47SY5/
mailing-list, third-party-advisory
- lists.debian.org /debian-lts-announce/2025/02/msg00008.html
Sources
- CVE List CVE-2023-3758
- NVD CVE-2023-3758
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.