Sssd: race condition during authorization leads to gpo policies functioning inconsistently (sssd)

CVE-2023-3758

HIGH 7.1

At a glance

Source: NVD
EPSS: EPSS 1.03 % · percentile 64 (2026-10-29)
State: PUBLISHED
Published: 2024-04-18 19:06 UTC
Updated: 2025-11-06 22:57 UTC
Assigner: redhat
NVD status: Modified

Search on…

Description

A race condition flaw was found in sssd where the GPO policy is not consistently applied for authenticated users. This may lead to improper authorization issues, granting or denying access to resources inappropriately.

Weaknesses (CWE)

CWE-362 — Concurrent Execution using Shared Resource with Improper Synchronization

References

Scores

Version	Score	Vector	Scored by
CVSS 3.1	HIGH 7.1	CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H	redhat
CVSS 3.1	HIGH 7.1	CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H	CISA-ADP
CVSS 3.1	HIGH 7.1	CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H	NVD · secalert@redhat.com (Secondary)
CVSS 3.1	HIGH 7.1	CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H	NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

European references

ENISA EUVD · EUVD-2023-44393
GCVE · GCVE-0-2023-3758

CERT-FR advisories

CERTFR-2024-AVI-0506 — Multiples vulnérabilités dans Juniper Secure Analytics · cert.ssi.gouv.fr
CERTFR-2024-AVI-0470 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr

Affected configurations (NVD CPE)

cpe:2.3:a:fedoraproject:sssd:*:*:*:*:*:*:*:* < 2.9.5
cpe:2.3:a:redhat:codeready_linux_builder:8.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:codeready_linux_builder_eus:8.6:*:*:*:*:*:*:*
cpe:2.3:a:redhat:codeready_linux_builder_eus:8.8:*:*:*:*:*:*:*
cpe:2.3:a:redhat:codeready_linux_builder_eus:9.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:codeready_linux_builder_eus:9.2:*:*:*:*:*:*:*
cpe:2.3:a:redhat:codeready_linux_builder_eus:9.4:*:*:*:*:*:*:*
cpe:2.3:a:redhat:codeready_linux_builder_eus:9.6:*:*:*:*:*:*:*
cpe:2.3:a:redhat:codeready_linux_builder_for_arm64:8.0_aarch64:*:*:*:*:*:*:*
cpe:2.3:a:redhat:codeready_linux_builder_for_arm64_eus:8.6_aarch64:*:*:*:*:*:*:*
cpe:2.3:a:redhat:codeready_linux_builder_for_arm64_eus:8.8_aarch64:*:*:*:*:*:*:*
cpe:2.3:a:redhat:codeready_linux_builder_for_arm64_eus:9.0_aarch64:*:*:*:*:*:*:*
cpe:2.3:a:redhat:codeready_linux_builder_for_arm64_eus:9.2_aarch64:*:*:*:*:*:*:*
cpe:2.3:a:redhat:codeready_linux_builder_for_arm64_eus:9.4_aarch64:*:*:*:*:*:*:*
cpe:2.3:a:redhat:codeready_linux_builder_for_arm64_eus:9.6_aarch64:*:*:*:*:*:*:*
cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems:8.0_s390x:*:*:*:*:*:*:*
cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems_eus:8.6_s390x:*:*:*:*:*:*:*
cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems_eus:8.8_s390x:*:*:*:*:*:*:*
cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems_eus:9.0_s390x:*:*:*:*:*:*:*
cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems_eus:9.2_s390x:*:*:*:*:*:*:*
cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems_eus:9.4_s390x:*:*:*:*:*:*:*
cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems_eus:9.6_s390x:*:*:*:*:*:*:*
cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian:8.0_ppc64le:*:*:*:*:*:*:*
cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian_eus:8.6_ppc64le:*:*:*:*:*:*:*
cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian_eus:8.8_ppc64le:*:*:*:*:*:*:*
cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian_eus:9.0_ppc64le:*:*:*:*:*:*:*
cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian_eus:9.2_ppc64le:*:*:*:*:*:*:*
cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian_eus:9.4_ppc64le:*:*:*:*:*:*:*
cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian_eus:9.6_ppc64le:*:*:*:*:*:*:*
cpe:2.3:a:redhat:virtualization_host:4.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:8.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:8.8:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:9.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:9.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:9.4:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:9.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_arm_64:8.0_aarch64:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:8.6_aarch64:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:8.8_aarch64:*:*:*:*:*:*:*
+39 more

Affected products

Product	Versions
sssd	affected 0 < 2.9.5
Red Hat · Red Hat Enterprise Linux 8	unaffected 0:2.9.4-3.el8_10 < *
Red Hat · Red Hat Enterprise Linux 8	unaffected 0:2.9.4-3.el8_10 < *
Red Hat · Red Hat Enterprise Linux 8.6 Extended Update Support	unaffected 0:2.6.2-4.el8_6.3 < *
Red Hat · Red Hat Enterprise Linux 8.8 Extended Update Support	unaffected 0:2.8.2-4.el8_8.2 < *
Red Hat · Red Hat Enterprise Linux 9	unaffected 0:2.9.4-6.el9_4 < *
Red Hat · Red Hat Enterprise Linux 9	unaffected 0:2.9.4-6.el9_4 < *
Red Hat · Red Hat Enterprise Linux 9.0 Extended Update Support	unaffected 0:2.6.2-4.el9_0.3 < *
Red Hat · Red Hat Enterprise Linux 9.2 Extended Update Support	unaffected 0:2.8.2-5.el9_2.4 < *
Red Hat · Red Hat Virtualization 4 for Red Hat Enterprise Linux 8	unaffected 0:2.6.2-4.el8_6.3 < *
Red Hat · Red Hat Enterprise Linux 6
Red Hat · Red Hat Enterprise Linux 7

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD

⚠️ Sssd: race condition during authorization leads to gpo policies functioning inconsistently (sssd)