Skip to main content

Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)

CVE-2024-9312

Medium
5.5/10

Summary

The package github.com/ubuntu/authd versions through 0.3.6, did not sufficiently randomize user "IDs" to prevent collisions. A local attacker who can register user names could spoof another user's ID and gain their privileges.

  • HIGH
  • LOCAL
  • HIGH
  • UNCHANGED
  • NONE
  • HIGH
  • HIGH
  • HIGH

CWE-335 - Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)

The software uses a Pseudo-Random Number Generator (PRNG) but does not correctly manage seeds.

References

Advisory Timeline

  • Published