CVE-2024-9312
📋 TL;DR
CVE-2024-9312 is an authentication bypass vulnerability in authd where insufficient user ID randomization allows local attackers to spoof other users' IDs. This enables privilege escalation where an attacker could gain the privileges of any user on the system. Systems running authd version 0.3.6 or earlier are affected.
💻 Affected Systems
- authd
📦 What is this software?
Authd by Canonical
⚠️ Risk & Real-World Impact
Worst Case
Attacker gains root privileges by spoofing root user ID, leading to complete system compromise
Likely Case
Local attacker escalates to another user's privileges, potentially accessing sensitive data or performing unauthorized actions
If Mitigated
Attack limited to local users only, with proper access controls preventing critical system access
🎯 Exploit Status
Requires local user access and ability to register user names
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.3.7 or later
Vendor Advisory: https://github.com/ubuntu/authd/security/advisories/GHSA-4gfw-wf7c-w6g2
Restart Required: Yes
Instructions:
1. Update authd to version 0.3.7 or later using your package manager. 2. Restart the authd service. 3. Verify the update was successful.
🔧 Temporary Workarounds
Disable local user registration
linuxPrevent new user registration to block the attack vector
# Configure authd to disable user registration
# Check authd configuration for registration settings
Restrict local user access
linuxLimit which users can access the system locally
# Use PAM or other access controls to restrict local login
# Review /etc/security/access.conf and other access control files
🧯 If You Can't Patch
- Implement strict access controls to limit which users can log in locally
- Monitor for suspicious authentication events and user privilege changes
🔍 How to Verify
Check if Vulnerable:
Check authd version with 'authd --version' or package manager queryCheck Version:
authd --version || dpkg -l | grep authd || rpm -qa | grep authdVerify Fix Applied:
Verify authd version is 0.3.7 or later and check that user ID collisions are properly randomized📡 Detection & Monitoring
Log Indicators:
- Multiple user registrations with similar timing
- User privilege escalation without proper authentication
- Failed authentication attempts followed by successful access
Network Indicators:
- Local authentication anomalies
- Unexpected user privilege changes
SIEM Query:
source="authd.log" AND ("user registration" OR "privilege escalation")