CVE-2025-14104
📋 TL;DR
A heap buffer overread vulnerability in util-linux's setpwnam() function allows reading beyond allocated memory when processing 256-byte usernames. This affects SUID login-utils utilities that write to the password database, potentially exposing sensitive memory contents. Systems running vulnerable versions of util-linux with SUID utilities are affected.
💻 Affected Systems
- util-linux
⚠️ Risk & Real-World Impact
Worst Case
Information disclosure of sensitive memory contents including passwords, keys, or other credentials from adjacent memory regions, potentially leading to privilege escalation or lateral movement.
Likely Case
Information disclosure of limited memory contents, possibly causing application crashes or exposing non-critical system information.
If Mitigated
Minimal impact with proper memory protections and exploit mitigations in place, potentially causing only application instability.
🎯 Exploit Status
Exploitation requires crafting a 256-byte username and triggering the vulnerable code path through SUID utilities.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions patched in RHSA-2026:1696, RHSA-2026:1852, and RHSA-2026:1913
Vendor Advisory: https://access.redhat.com/security/cve/CVE-2025-14104
Restart Required: No
Instructions:
1. Update util-linux package using your distribution's package manager. 2. For RHEL/CentOS: 'yum update util-linux' or 'dnf update util-linux'. 3. For Debian/Ubuntu: 'apt update && apt upgrade util-linux'. 4. Verify the update completed successfully.
🔧 Temporary Workarounds
Remove SUID bits from affected utilities
linuxTemporarily remove SUID permissions from login-utils utilities to prevent exploitation while maintaining functionality for most users.
chmod u-s /usr/bin/login
chmod u-s /usr/bin/su
Restrict username lengths
linuxImplement system-wide restrictions on maximum username length to prevent triggering the 256-byte condition.
echo 'maxlen 255' >> /etc/security/limits.conf
🧯 If You Can't Patch
- Implement strict access controls to limit who can execute SUID utilities
- Deploy memory protection mechanisms like ASLR and stack canaries to reduce exploit effectiveness
🔍 How to Verify
Check if Vulnerable:
Check util-linux version and compare against patched versions in Red Hat advisories: 'rpm -q util-linux' or 'dpkg -l util-linux'Check Version:
rpm -q util-linux --qf '%{VERSION}-%{RELEASE}\n' # RHEL/CentOS or dpkg -l util-linux | grep ^ii # Debian/UbuntuVerify Fix Applied:
Verify util-linux package version matches or exceeds versions listed in RHSA-2026:1696/1852/1913 advisories📡 Detection & Monitoring
Log Indicators:
- Failed authentication attempts with unusually long usernames (256 bytes)
- Application crashes in login-utils utilities
- System log entries showing memory access violations
Network Indicators:
- None - this is a local vulnerability
SIEM Query:
source="auth.log" AND (username_length>=256 OR "buffer overread" OR "segmentation fault" AND process="login" OR process="su")