CVE-2023-3758

Sssd: race condition during authorization leads to gpo policies functioning inconsistently

State: Published
Severity: 7.1 High
Published: Apr 18, 2024
Updated: Nov 6, 2025
Reserved: Jul 18, 2023

Description

A race condition flaw was found in sssd where the GPO policy is not consistently applied for authenticated users. This may lead to improper authorization issues, granting or denying access to resources inappropriately.

Scores

CVSS	Score	Vector	Source
3.1	7.1 High	CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H	redhat
3.1	7.1 High	CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Affected Products

Product	Versions
sssd	before 2.9.5Affected
Red Hat Enterprise Linux 8Red Hat	0:2.9.4-3.el8_10 and laterNot affected
Red Hat Enterprise Linux 8Red Hat	0:2.9.4-3.el8_10 and laterNot affected
Red Hat Enterprise Linux 8.6 Extended Update SupportRed Hat	0:2.6.2-4.el8_6.3 and laterNot affected
Red Hat Enterprise Linux 8.8 Extended Update SupportRed Hat	0:2.8.2-4.el8_8.2 and laterNot affected
Red Hat Enterprise Linux 9Red Hat	0:2.9.4-6.el9_4 and laterNot affected
Red Hat Enterprise Linux 9Red Hat	0:2.9.4-6.el9_4 and laterNot affected
Red Hat Enterprise Linux 9.0 Extended Update SupportRed Hat	0:2.6.2-4.el9_0.3 and laterNot affected
Red Hat Enterprise Linux 9.2 Extended Update SupportRed Hat	0:2.8.2-5.el9_2.4 and laterNot affected
Red Hat Virtualization 4 for Red Hat Enterprise Linux 8Red Hat	0:2.6.2-4.el8_6.3 and laterNot affected
Red Hat Enterprise Linux 6Red Hat
Red Hat Enterprise Linux 7Red Hat

References

RHSA-2024:1919vendor-advisory
RHSA-2024:1920vendor-advisory
RHSA-2024:1921vendor-advisory
RHSA-2024:1922vendor-advisory
RHSA-2024:2571vendor-advisory
RHSA-2024:3270vendor-advisory
https://access.redhat.com/security/cve/CVE-2023-3758vdb-entry
RHBZ#2223762issue-tracking
https://github.com/SSSD/sssd/pull/7302
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RV3HIZI3SURBUQKSOOL3XE64OOBQ2HTK/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XEP62IDS7A55D5UHM6GH7QZ7SQFOAPVF/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XMORAO2BDDA5YX4ZLMXDZ7SM6KU47SY5/
https://lists.debian.org/debian-lts-announce/2025/02/msg00008.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.