-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe analysis started by fetching content from the provided URLs. The Bugzilla link (https://bugzilla.redhat.com/show_bug.cgi?id=2215945) provided a direct link to the upstream commit fixing the vulnerability: https://github.com/shadow-maint/shadow/commit/65c88a43a23c2391dcc90c0abda3e839e9c57904. The commit information for this patch was then retrieved. The patch clearly shows modifications in the change_passwd function within src/gpasswd.c. The commit message explicitly states that the vulnerability occurs when the second password prompt (using agetpass) fails, and the pass buffer (a static variable within change_passwd) is not zeroed. The added line memzero(pass, sizeof pass); directly addresses this by clearing the buffer. Therefore, change_passwd is the function where the vulnerability existed and was subsequently fixed.
A Semantic Attack on Google Gemini - Read the Latest Research