EUVD-2026-194668

fkie_cve-2024-9312

Authd, through version 0.3.6, did not sufficiently randomize user IDs to prevent collisions. A local attacker who can register user names could spoof another user's ID and gain their privileges.

GHSA-4gfw-wf7c-w6g2 — Authd allows attacker-controlled usernames to yield controllable UIDs

Affected: Go: github.com/ubuntu/authd

CVE description:

Authd, through version 0.3.6, did not sufficiently randomize user IDs to prevent collisions. A local attacker who can register user names could spoof another user's ID and gain their privileges.

----- original report ----- # Cause authd assigns user IDs as a pure function of the user name. Moreover, the set of UIDs is much too small for pseudo-random assignment to work: the birthday bound predicts random collisions will occur with probability 50% after only 54 562 IDs were assigned.

`authd` only checks for uniqueness [within its local cache](https://github.com/ubuntu/authd/blob/4946962aa4ac6e5b7d2b53503026659581c73907/internal/users/cache/update.go#L67-L71), which - may be inconsistent across multiple systems within the same domain ; - may be purged, due to being stored in `/var/cache` ; - automatically removes entries of users who have not logged into that specific system within the last 6 months.

The current `GenerateID` method, authored in September 2024 (commit a6c85ed24b8d17a2d11c859e8d70f5a52fa69690), repeatedly hashes the user name until the 4 leading bytes fall into the interval [60 000; 2³¹[ : https://github.com/ubuntu/authd/blob/f9f851540e6377fca18a45ce7a02d024c1dbd6e9/internal/users/manager.go#L425 https://github.com/ubuntu/authd/blob/f9f851540e6377fca18a45ce7a02d024c1dbd6e9/internal/services/nss/nss.go#L188

Previous versions are affected by similar issues, though without the use of a cryptographic hash in `GenerateID`, making exploitation c…

openSUSE-SU-2024:0350-1 — Security update for govulncheck-vulndb

Security update for govulncheck-vulndb