CVE-2023-3758

Q: What is the severity of CVE-2023-3758?

CVE-2023-3758 has a CVSS score of 7.1 (HIGH). A race condition in SSSD (System Security Services Daemon) causes inconsistent application of Group Policy Object (GPO) policies for authenticated users. This can lead to improper authorization decisions, potentially granting or denying access to resources incorrectly. Systems using SSSD for authentication/authorization with Active Directory integration are affected.

7.1 HIGH

Authentication Bypass

📋 TL;DR

A race condition in SSSD (System Security Services Daemon) causes inconsistent application of Group Policy Object (GPO) policies for authenticated users. This can lead to improper authorization decisions, potentially granting or denying access to resources incorrectly. Systems using SSSD for authentication/authorization with Active Directory integration are affected.

💻 Affected Systems

Products:

sssd

Versions: Specific versions not provided in references; check Red Hat advisories for affected versions

Operating Systems: Red Hat Enterprise Linux and derivatives using SSSD with AD integration

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects configurations using SSSD with Active Directory GPO policy enforcement enabled.

📦 What is this software?

Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions by Redhat

View all CVEs affecting Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions →

Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions by Redhat

View all CVEs affecting Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions →

Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions by Redhat

View all CVEs affecting Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions →

Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions by Redhat

View all CVEs affecting Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions →

Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions by Redhat

View all CVEs affecting Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions →

Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions by Redhat

View all CVEs affecting Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions →

Enterprise Linux Server Tus by Redhat

View all CVEs affecting Enterprise Linux Server Tus →

Enterprise Linux Server Tus by Redhat

View all CVEs affecting Enterprise Linux Server Tus →

Enterprise Linux Update Services For Sap Solutions by Redhat

View all CVEs affecting Enterprise Linux Update Services For Sap Solutions →

Enterprise Linux Update Services For Sap Solutions by Redhat

View all CVEs affecting Enterprise Linux Update Services For Sap Solutions →

Enterprise Linux Update Services For Sap Solutions by Redhat

View all CVEs affecting Enterprise Linux Update Services For Sap Solutions →

Enterprise Linux Update Services For Sap Solutions by Redhat

View all CVEs affecting Enterprise Linux Update Services For Sap Solutions →

Enterprise Linux Update Services For Sap Solutions by Redhat

View all CVEs affecting Enterprise Linux Update Services For Sap Solutions →

Enterprise Linux Update Services For Sap Solutions by Redhat

View all CVEs affecting Enterprise Linux Update Services For Sap Solutions →

Fedora by Fedoraproject

View all CVEs affecting Fedora →

Fedora by Fedoraproject

View all CVEs affecting Fedora →

Fedora by Fedoraproject

View all CVEs affecting Fedora →

Sssd by Fedoraproject

View all CVEs affecting Sssd →

Virtualization Host by Redhat

View all CVEs affecting Virtualization Host →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Unauthorized users gain access to sensitive resources or authorized users are improperly denied access to critical systems, potentially leading to data breaches or operational disruption.

🟠

Likely Case

Intermittent authorization failures or unexpected access permissions for users in AD-integrated environments, causing access control inconsistencies.

🟢

If Mitigated

Minimal impact with proper network segmentation and additional authorization controls, though inconsistent policy application may still occur.

🌐 Internet-Facing: LOW - SSSD is typically used internally for domain authentication, not directly internet-facing.

🏢 Internal Only: HIGH - Directly impacts internal authentication and authorization systems in AD environments.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM - Requires race condition triggering during authentication

Exploitation requires timing attacks during user authentication processes.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Check specific Red Hat advisories for patched versions

Vendor Advisory: https://access.redhat.com/errata/RHSA-2024:1919

Restart Required: Yes

Instructions:

1. Check current sssd version. 2. Apply appropriate Red Hat security update via yum update sssd. 3. Restart sssd service: systemctl restart sssd. 4. Verify update applied.

🔧 Temporary Workarounds

Disable GPO enforcement

linux

Temporarily disable GPO policy enforcement in SSSD configuration

sed -i 's/^ldap_gpo.*/ldap_gpo = False/' /etc/sssd/sssd.conf
systemctl restart sssd

🧯 If You Can't Patch

Implement additional network segmentation to limit access to sensitive resources
Add secondary authorization controls independent of SSSD GPO policies

🔍 How to Verify

Check if Vulnerable:

Check sssd version and if using AD GPO: rpm -q sssd && grep ldap_gpo /etc/sssd/sssd.conf

Check Version:

rpm -q sssd --queryformat '%{VERSION}-%{RELEASE}\n'

Verify Fix Applied:

Verify updated sssd version and test authentication with GPO policies

📡 Detection & Monitoring

Log Indicators:

SSSD logs showing inconsistent GPO application
Authentication failures/successes that violate expected policies

Network Indicators:

Unexpected LDAP queries during authentication

SIEM Query:

source="sssd" AND ("GPO" OR "policy") AND ("inconsistent" OR "race")

📊 Metadata

CVE ID: CVE-2023-3758

CVSS v3 Score: 7.1 (HIGH)

CVSS Vector: CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-362

Published: April 18, 2024

Last Updated: November 3, 2025

🔗 References

https://access.redhat.com/errata/RHSA-2024:1919 Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:1920 Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:1921 Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:1922 Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:2571 Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:3270 Third Party Advisory
https://access.redhat.com/security/cve/CVE-2023-3758 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2223762 Issue Tracking,Third Party Advisory
https://github.com/SSSD/sssd/pull/7302 Exploit,Issue Tracking,Patch
https://access.redhat.com/errata/RHSA-2024:1919 Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:1920 Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:1921 Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:1922 Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:2571 Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:3270 Third Party Advisory
https://access.redhat.com/security/cve/CVE-2023-3758 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2223762 Issue Tracking,Third Party Advisory
https://github.com/SSSD/sssd/pull/7302 Exploit,Issue Tracking,Patch
https://lists.debian.org/debian-lts-announce/2025/02/msg00008.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RV3HIZI3SURBUQKSOOL3XE64OOBQ2HTK/ Mailing List,Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XEP62IDS7A55D5UHM6GH7QZ7SQFOAPVF/ Mailing List,Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XMORAO2BDDA5YX4ZLMXDZ7SM6KU47SY5/ Mailing List,Third Party Advisory

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Codeready Linux Builder by Redhat

Codeready Linux Builder Eus by Redhat

Codeready Linux Builder Eus by Redhat

Codeready Linux Builder Eus by Redhat

Codeready Linux Builder Eus by Redhat

Codeready Linux Builder Eus by Redhat

Codeready Linux Builder Eus by Redhat

Codeready Linux Builder For Arm64 by Redhat

Codeready Linux Builder For Arm64 Eus by Redhat

Codeready Linux Builder For Arm64 Eus by Redhat

Codeready Linux Builder For Arm64 Eus by Redhat

Codeready Linux Builder For Arm64 Eus by Redhat

Codeready Linux Builder For Arm64 Eus by Redhat

Codeready Linux Builder For Arm64 Eus by Redhat

Codeready Linux Builder For Ibm Z Systems by Redhat

Codeready Linux Builder For Ibm Z Systems Eus by Redhat

Codeready Linux Builder For Ibm Z Systems Eus by Redhat

Codeready Linux Builder For Ibm Z Systems Eus by Redhat

Codeready Linux Builder For Ibm Z Systems Eus by Redhat

Codeready Linux Builder For Ibm Z Systems Eus by Redhat

Codeready Linux Builder For Ibm Z Systems Eus by Redhat

Codeready Linux Builder For Power Little Endian by Redhat

Codeready Linux Builder For Power Little Endian Eus by Redhat

Codeready Linux Builder For Power Little Endian Eus by Redhat

Codeready Linux Builder For Power Little Endian Eus by Redhat

Codeready Linux Builder For Power Little Endian Eus by Redhat

Codeready Linux Builder For Power Little Endian Eus by Redhat

Codeready Linux Builder For Power Little Endian Eus by Redhat

Enterprise Linux by Redhat

Enterprise Linux Eus by Redhat

Enterprise Linux Eus by Redhat

Enterprise Linux Eus by Redhat

Enterprise Linux Eus by Redhat

Enterprise Linux Eus by Redhat

Enterprise Linux Eus by Redhat

Enterprise Linux For Arm 64 by Redhat

Enterprise Linux For Arm 64 Eus by Redhat

Enterprise Linux For Arm 64 Eus by Redhat

Enterprise Linux For Arm 64 Eus by Redhat

Enterprise Linux For Arm 64 Eus by Redhat

Enterprise Linux For Arm 64 Eus by Redhat

Enterprise Linux For Arm 64 Eus by Redhat

Enterprise Linux For Ibm Z Systems by Redhat

Enterprise Linux For Ibm Z Systems Eus by Redhat

Enterprise Linux For Ibm Z Systems Eus by Redhat

Enterprise Linux For Ibm Z Systems Eus by Redhat

Enterprise Linux For Ibm Z Systems Eus by Redhat

Enterprise Linux For Ibm Z Systems Eus by Redhat

Enterprise Linux For Ibm Z Systems Eus by Redhat

Enterprise Linux For Power Little Endian by Redhat

Enterprise Linux For Power Little Endian Eus by Redhat

Enterprise Linux For Power Little Endian Eus by Redhat

Enterprise Linux For Power Little Endian Eus by Redhat

Enterprise Linux For Power Little Endian Eus by Redhat

Enterprise Linux For Power Little Endian Eus by Redhat

Enterprise Linux For Power Little Endian Eus by Redhat

Enterprise Linux Server Aus by Redhat

Enterprise Linux Server Aus by Redhat

Enterprise Linux Server Aus by Redhat

Enterprise Linux Server Aus by Redhat

Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions by Redhat

Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions by Redhat

Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions by Redhat

Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions by Redhat

Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions by Redhat

Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions by Redhat

Enterprise Linux Server Tus by Redhat

Enterprise Linux Server Tus by Redhat

Enterprise Linux Update Services For Sap Solutions by Redhat

Enterprise Linux Update Services For Sap Solutions by Redhat

Enterprise Linux Update Services For Sap Solutions by Redhat

Enterprise Linux Update Services For Sap Solutions by Redhat

Enterprise Linux Update Services For Sap Solutions by Redhat

Enterprise Linux Update Services For Sap Solutions by Redhat

Fedora by Fedoraproject

Fedora by Fedoraproject

Fedora by Fedoraproject