Junglewise Threat Intelligence

CVE-2025-14104: util-linux heap buffer overread in setpwnam function

CVE-2025-14104 · Severity: medium · CVSS 6.1 · Published 2025-12-05

Technologies: Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 10. Vendors: Red Hat.

Executive brief

A security vulnerability has been identified in util-linux, a core set of tools used by Linux operating systems for basic tasks like logging in and managing disks. An attacker with local access to a system could exploit this flaw to cause a system crash or potentially access restricted memory. This could disrupt operations or lead to a denial of service on affected servers and workstations.

Technical details

A heap buffer overread vulnerability (CWE-125) exists in the util-linux package within the setpwnam() function. The flaw is triggered when the utility processes specially crafted 256-byte usernames while writing to the password database. This affects SUID (Set User ID) login-utils, which run with elevated privileges. A local, authenticated attacker can exploit this to read sensitive information from heap memory or cause a denial of service (crash). The issue is addressed in util-linux version 2.41.3 and various Red Hat Enterprise Linux package updates.

Affected products

  • util-linux util-linux < 2.41.3
  • Red Hat Red Hat Enterprise Linux 8 < 2.32.1-48.el8_10
  • Red Hat Red Hat Enterprise Linux 9 < 2.37.4-21.el9_7
  • Red Hat Red Hat Enterprise Linux 10 < 2.40.2-15.el10_1

Timeline

  • 2025-12-05: advisory: Initial NVD publication date
  • 2026-02-02: patched: Red Hat released patches for RHEL 10
  • 2026-02-03: patched: Red Hat released patches for RHEL 8

References

Related threats