CVE-2024-2905: 
Alma Linux vulnerability analysis and mitigation

A security vulnerability (CVE-2024-2905) was discovered in rpm-ostree, where the /etc/shadow file in default builds has the world-readable bit enabled. The vulnerability was first identified on April 25, 2024, affecting rpm-ostree versions starting with v2023.6. The issue impacts new installations of Red Hat Enterprise Linux 9 and Fedora systems (Atomic Desktops, IoT, and CoreOS) version 39 and later (NVD, Red Hat CVE).

The vulnerability stems from incorrect permission assignments for critical resources (CWE-732), specifically the /etc/shadow, /etc/shadow-, /etc/gshadow, and /etc/gshadow- files having world-readable permissions. The CVSS v3.1 base score is 6.2 (Medium) with vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating local access required but no privileges needed to exploit (Red Hat CVE, GitHub Advisory).

This vulnerability allows local, unconfined applications to read the hashed passwords for all users of the system. On systems with SELinux enabled and in enforcing mode, access to these files is limited to unconfined users, unconfined systemd services, and privileged containers. Confined daemons, users, and containers are not affected. Systems that were installed before this vulnerability or use only SSH keys for authentication are not impacted (Red Hat CVE).

The vulnerability requires local access to the system but no special privileges. To gain further system access, an attacker would need to brute-force the hashed passwords to discover the real passwords that could be used for authentication, for example over SSH (Red Hat CVE).

The issue has been patched in rpm-ostree version 2024.4. For immediate mitigation on affected systems, administrators can run the following command as root: chmod --verbose 0000 /etc/shadow /etc/gshadow /etc/shadow- /etc/gshadow-. As a precaution, it is recommended to rotate all user credentials stored in these files (GitHub Advisory, Red Hat CVE).