CVE-2024-9312: 
Linux openSUSE vulnerability analysis and mitigation

Authd, through version 0.3.6, contains a security vulnerability (CVE-2024-9312) that was disclosed on October 10, 2024. The vulnerability affects the authentication daemon used for managing identity and access on Ubuntu machines. The flaw stems from insufficient randomization of user IDs, which could allow local attackers to spoof another user's ID and gain their privileges. This vulnerability has been assigned a CVSS score of 7.6 (High) (Security Online, NVD).

The vulnerability exists in Authd's user ID generation mechanism, where user IDs are assigned as a pure function of the username. The system's GenerateID function uses insufficient randomization, making it vulnerable to collisions. The set of UIDs is too small for pseudo-random assignment to work effectively, with a 50% probability of random collisions after only 54,562 IDs are assigned. The vulnerability affects versions through 0.3.6, and the attack can be executed entirely offline, with an estimated computational cost of about 10 minutes on a single-core system (GitHub Advisory).

The vulnerability allows attackers to impersonate users on systems where Authd is deployed. Attackers can manipulate critical files and settings, such as ~/.ssh/authorized_keys or ~/.config, potentially leading to further exploitation of shared network resources. The impact is particularly severe in environments where multiple systems share resources, as compromising one system could lead to unauthorized access across the network (Security Online).

Canonical has released version 0.3.6 of Authd to address CVE-2024-9312. The advisory recommends that identity providers should issue guaranteed-unique user IDs to prevent collisions, a feature supported by many OpenID Connect (OIDC) providers like LDAP and Active Directory. If organizations cannot rely on external identity providers to generate unique IDs, architectural changes to Authd are necessary to prevent future attacks, including managing mutable state across multiple machines to ensure proper synchronization of user IDs (ASEC, GitHub Advisory).