Privilege Escalation Vulnerability in GNU Inetutils Products

CVE-2023-40303

What is CVE-2023-40303?

GNU Inetutils, through version 2.4, contains a vulnerability that allows for privilege escalation due to the lack of validation on the return values of the set*id() family of functions within several components such as ftpd, rcp, rlogin, rsh, rshd, and uucpd. This issue can be exploited when a process attempts to drop privileges, as failures in the setuid system call could lead to situations where an ordinary user inadvertently gains control over the process, leading to potential unauthorized actions.

References