Skip to content

Back to the catalog

bencteux.fradvisory

CVE-2023-40303: unchecked return values of set*id() family functions in GNU inetutils

Disclosure writeup for CVE-2023-40303, found by the author, describing how GNU inetutils fails to check return values of set*id() family calls (setuid/setgid/etc.) across several of its binaries, including the ftpd, rcp, rlogin, rsh, rshd, and uucpd utilities. Because privilege-dropping calls are not verified, failure conditions can leave a process running with unintended elevated privileges, enabling local or in some server-daemon cases remote privilege escalation; the fix landed in the inetutils master branch ahead of a future release.

TL;DR GNU inetutils' ftpd, rcp, rlogin, rsh, rshd, and uucpd don't check set*id() return values, enabling privilege escalation (CVE-2023-40303).
Open original ↗
Document

What it is

CVE-2023-40303, unchecked return values of the set*id() family (setuid, setgid, etc.) in GNU inetutils, the FSF-maintained network utilities suite. When a privilege-dropping call silently fails and its return value goes unchecked, the process keeps running with elevated privileges. Assigned 2023-08-14.

Preconditions / Affected

The page names the specific vulnerable binaries — this is the detail the summary omits:

  • ftpd
  • rcp
  • rlogin
  • rsh
  • rshd
  • uucpd

Several are server daemons (ftpd, rshd), which the author notes opens the door to remote exploitation rather than local-only. The author stresses the impact "is quite dependent on which of the unchecked return value set*id call you pick" — it is not uniform across all six, and escalation only occurs "under particular conditions" where the drop actually fails.

What to do

The page gives no patch commands. The relevant status: the fix is only in the master branch of inetutils.git at the time of writing, not in any tagged release — the author speculates it will ship in "the next version (2.5?)." An engineer relying on a distro package should therefore assume a released, unpatched build unless their distro has backported the fix. Audit whether any of the six binaries above are installed and reachable (especially the daemons) rather than waiting on the version bump.

Caveats

  • Exploitability is conditional, not guaranteed: it requires the set*id() call to fail in the first place (e.g., resource limits on the target uid), which does not happen in normal operation.
  • The author frames these as "textbook cases" of a broader class covered in a separate earlier article, "On checking set*id() return values" — the general reasoning lives there, not on this page.
  • No CVSS score, no proof-of-concept, and no per-binary breakdown of which calls are the dangerous ones are provided here.

CVEs named here

Technologies named here

Techniques named here

Related in AppSec