CVE-2021-40084
📋 TL;DR
CVE-2021-40084 is a critical vulnerability in opensysusers (versions through 0.6) that allows remote code execution via shell injection in the GECOS field. Attackers can execute arbitrary commands with root privileges by crafting malicious sysusers.d configuration files. This affects systems using opensysusers for user management instead of systemd-sysusers.
💻 Affected Systems
- opensysusers
📦 What is this software?
Opensysusers by Artixlinux
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with root-level arbitrary code execution, allowing complete control over the affected system, data theft, and lateral movement.
Likely Case
Privilege escalation to root and installation of persistent backdoors or malware on vulnerable systems.
If Mitigated
Limited impact if proper file permissions prevent unauthorized writes to sysusers.d directory and if opensysusers is not used.
🎯 Exploit Status
Exploitation requires ability to create or modify files in the sysusers.d directory. The vulnerability is in the eval() function handling shell metacharacters in configuration files.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 0.7 and later
Vendor Advisory: https://github.com/artix-linux/opensysusers/releases
Restart Required: No
Instructions:
1. Update opensysusers to version 0.7 or later using your package manager. 2. For Artix Linux: 'pacman -Syu opensysusers'. 3. For other distributions: use appropriate package manager commands to update to patched version.
🔧 Temporary Workarounds
Replace opensysusers with systemd-sysusers
linuxSwitch to systemd-sysusers which is not vulnerable to this issue and follows the same specification
# Remove opensysusers and install systemd-sysusers
pacman -R opensysusers
pacman -S systemd-sysusers
Restrict sysusers.d directory permissions
linuxSet strict permissions on /etc/sysusers.d/ to prevent unauthorized file creation/modification
chmod 700 /etc/sysusers.d/
chown root:root /etc/sysusers.d/
🧯 If You Can't Patch
- Monitor /etc/sysusers.d/ directory for unauthorized file changes using file integrity monitoring
- Implement strict access controls to prevent unauthorized users from writing to sysusers.d directory
🔍 How to Verify
Check if Vulnerable:
Check opensysusers version: 'opensysusers --version' or 'pacman -Qi opensysusers'. If version is 0.6 or earlier, system is vulnerable.Check Version:
opensysusers --version || pacman -Qi opensysusers | grep VersionVerify Fix Applied:
Verify opensysusers version is 0.7 or later: 'opensysusers --version' should show 0.7+📡 Detection & Monitoring
Log Indicators:
- Unusual processes spawned from opensysusers execution
- Unexpected file creation in /etc/sysusers.d/
- Failed attempts to write to sysusers.d directory
Network Indicators:
- Outbound connections from opensysusers process to unexpected destinations
SIEM Query:
process_name:"opensysusers" AND (command_line:"eval" OR command_line:"sh -c")