CVE-2023-40303: gnu inetutils Unchecked Return Value
Vulnerability summary
CVE-2023-40303 is a high (CVSS 7.8) Unchecked Return Value vulnerability in gnu inetutils. EPSS estimates a 0.41% chance of exploitation in the next 30 days, higher than 34% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 3 · Related 2Timeline
- 14-08-2023PublishedVulnerability first disclosed.
- 02-08-2024Last modifiedVulnerability information updated.
Description
GNU inetutils before 2.5 may allow privilege escalation because of unchecked return values of set*id() family functions in ftpd, rcp, rlogin, rsh, rshd, and uucpd. This is, for example, relevant if the setuid system call fails when a process is trying to drop privileges before letting an ordinary user control the activities of the process.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.41%
Chance of exploitation in the next 30 days
Percentile
34%
Versus all other CVEs
30-day change
0.00 pp
From 0.41% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (lists.gnu.org)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Debian1 product
- inetutils< 2:2.4-2+deb12u1 | < 2:2.4-3
Gnu1 product
- inetutils≤ 2.4
Ubuntu1 product
- inetutils< 2:1.9.2-1ubuntu0.1~esm2 | < 2:1.9.4-1ubuntu0.1~esm3 | < 2:1.9.4-3ubuntu0.1+esm2 | < 2:1.9.4-11ubuntu0.2 | < 2:2.2-2ubuntu0.1 | < 2:2.4-3ubuntu1
3 vendors · 3 products
References
10 links- lists.gnu.org/archive/html/bug-inetutils/2023-07/msg00000.htmlREPORTExploitMailing ListPatchVendor Advisory
- www.openwall.com/lists/oss-security/2023/12/30/4Mailing List