Executive Summary

The vulnerability exists in the id utility of uutils coreutils, where the "pretty print" output behaves incorrectly when the real UID and effective UID differ.

Specifically, the implementation mistakenly uses the effective GID instead of the effective UID during the name lookup for the effective user.

This causes misleading diagnostic output, which can confuse automated scripts or system administrators.

Useful 0 Not Useful 0

Impact Analysis

The misleading output from the id utility can lead to incorrect decisions about file permissions or access control.

Automated scripts or system administrators relying on this output might misinterpret user identity information, potentially causing improper permission settings or security configurations.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability causes the `id` utility in uutils coreutils to produce misleading diagnostic output when the real UID and effective UID differ, due to incorrect use of the effective GID instead of the effective UID during name lookup.

This misleading output can cause automated scripts or system administrators to make incorrect decisions regarding file permissions or access control.

While the CVE description and resources do not explicitly mention compliance with standards like GDPR or HIPAA, inaccurate permission or access control decisions could potentially lead to unauthorized access or improper handling of sensitive data, which may impact compliance with such regulations.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by testing the behavior of the uutils coreutils `id` command when the real UID and effective UID differ, especially when manipulating effective group IDs. Specifically, running the `id` command with manipulated user and group IDs can reveal incorrect or crashing behavior.

• Use the `setpriv` command to change effective user and group IDs and observe the output of the `id` command.
• Example commands to detect the issue include:
• 1. `sudo setpriv --regid 1337 --clear-groups target/release/id -p login root` — this may cause a crash with an error like "No such id: 1337".
• 2. `sudo setpriv --reuid 3000 --egid 2000 --clear-groups target/release/id` — check if the groups output is incorrect (e.g., shows `groups=0(root)` instead of `groups=2000(u2000)`).
• 3. `sudo setpriv --euid 3000 --egid 2000 --clear-groups target/release/id` — verify if the uid output is inconsistent (e.g., shows `uid=0(root)` instead of `uid=3000(u3000)`).

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate the vulnerability in the uutils coreutils 'id' command, you should avoid using the affected 'id' utility in environments where the real UID and effective UID differ, especially when scripts or administrators rely on its output for access control decisions.

Additionally, refrain from running the 'id' command with manipulated or non-existent group IDs that could trigger crashes or incorrect output.

Consider using the standard GNU coreutils 'id' command as a safer alternative until the issue in uutils coreutils is resolved.

Useful 0 Not Useful 0