Ubuntu Authd Privilege Escalation Vulnerability via SSH Authentication

A privilege escalation vulnerability exists in Ubuntu Authd versions prior to 0.5.4. When a new user logs in in an SSH session, they are incorrectly granted membership in the root group. This flaw arises from an issue in the temporary user record used by Authd in the pre-authentication Name Service Switch (NSS). As a result, users who should not have root privileges could gain elevated rights during their SSH session.

Impact

Exploitation of this vulnerability allows for local privilege escalation, granting unauthorized root privileges to users logging in via SSH for the first time.

Remediation

Users can upgrade to Authd version 0.5.4 or later to address this vulnerability. Alternatively, SSH server configurations can be adjusted to disallow authentication via Authd, such as by setting 'UsePAM no' or 'KbdInteractiveAuthentication no' in the 'sshd_config'.