CVE-2023-3758: Sssd: race condition during authorization leads to gpo policies functioning inconsistently
Vulnerability summary
CVE-2023-3758 is a high (CVSS 7.1) vulnerability in fedoraproject fedora. EPSS estimates a 1.03% chance of exploitation in the next 30 days, higher than 63.8% of scored vulnerabilities. 1 public exploit is recorded.
Public exploit (GitHub, Date unknown)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 1Timeline
- 18-04-2024PublishedVulnerability first disclosed.
- 06-11-2025Last modifiedVulnerability information updated.
Description
A race condition flaw was found in sssd where the GPO policy is not consistently applied for authenticated users. This may lead to improper authorization issues, granting or denying access to resources inappropriately.
CVSS metrics
5 scores · 5 sources · 1 version- OSV · Red hatEcosystem advisory · calculated7.1HighCVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated7.1HighCVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.1HighCVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- NVDNIST7.1HighCVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
1.03%
Chance of exploitation in the next 30 days
Percentile
64%
Versus all other CVEs
30-day change
No change 0.00 pp
From 1.03% on 04-10-2026
Known exploited
Compare KEV catalogsNot in the CISA KEV catalog.
Not in the ENISA CNW catalog.
Not in the CIRCL catalog.
Public exploits
1 foundSssd
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Known conditions: adjacent network, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Redhat81 products
- codeready_linux_builder8.0
- codeready_linux_builder_eus8.6 | 8.8 | 9.0 | 9.2 | 9.4 | 9.6
- codeready_linux_builder_for_arm648.0_aarch64
- codeready_linux_builder_for_arm64_eus8.6_aarch64 | 8.8_aarch64 | 9.0_aarch64 | 9.2_aarch64 | 9.4_aarch64 | 9.6_aarch64
- codeready_linux_builder_for_ibm_z_systems8.0_s390x
Suse24 products
- sssd&distro=SUSE Enterprise Storage 7.1< 1.16.1-150300.23.43.1
- sssd&distro=SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS< 1.16.1-150200.17.32.1
- sssd&distro=SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS< 1.16.1-150300.23.43.1
- sssd&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS< 2.5.2-150400.4.27.1
- sssd&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS< 2.5.2-150400.4.27.1
Opensuse4 products
- sssd&distro=openSUSE Leap 15.5< 2.5.2-150500.10.17.1
- sssd&distro=openSUSE Leap 15.6< 2.9.3-150600.3.3.1
- sssd&distro=openSUSE Leap Micro 5.3< 2.5.2-150400.4.27.1
- sssd&distro=openSUSE Leap Micro 5.4< 2.5.2-150400.4.27.1
Debian1 product
- sssd< 2.8.2-4+deb12u1 | < 2.9.5-1
Mageia1 product
- sssd< 2.8.2-2.1.mga9
Ubuntu1 product
- sssdAll versions (No fix recorded) | < 2.2.3-3ubuntu0.13 | < 2.6.3-1ubuntu3.3 | < 2.9.4-1.1ubuntu6.1
7 vendors · 114 products
References
41 links- access.redhat.com/errata/RHSA-2024:1919Vendor AdvisoryX Refsource REDHATAdvisoryREPORTThird Party Advisory
- access.redhat.com/errata/RHSA-2024:1920Vendor AdvisoryX Refsource REDHATAdvisoryREPORTThird Party Advisory
- access.redhat.com/errata/RHSA-2024:1921Vendor AdvisoryX Refsource REDHATAdvisoryREPORTThird Party Advisory
- access.redhat.com/errata/RHSA-2024:1922Vendor AdvisoryX Refsource REDHATAdvisoryREPORTThird Party Advisory
- access.redhat.com/errata/RHSA-2024:2571Vendor AdvisoryX Refsource REDHATAdvisoryThird Party Advisory
- access.redhat.com/errata/RHSA-2024:3270Vendor AdvisoryX Refsource REDHATAdvisoryThird Party Advisory
- bugzilla.redhat.com/show_bug.cgi?id=2223762Issue TrackingX Refsource REDHATREPORTThird Party Advisory