CVE-2023-29383: Abusing Linux chfn to Misrepresent /etc/passwd

Two years ago, I picked out chfn as a candidate to be reviewed for security bugs. Why chfn I hear you ask? (Thanks for asking.) It is one of a small number of Set owner User ID (SUID) programs loaded with Linux which means it runs with the permissions of the ‘root’ user regardless of the user who executes it, for it needs to modify the /etc/passwd file to do its job.

abusing asking bugs cve etc job linux permissions root security