Description

su-exec through 0.3 fails to validate numeric user and group identifiers parsed with strtol before assigning to uid_t and gid_t, allowing truncation of out-of-range values to zero. Attackers can supply large numeric identifiers that truncate to root's identifier, causing su-exec to execute target programs with root privileges instead of intended unprivileged accounts.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-29T14:16:38.910Z",
  "pubdate": "2026-08-29T14:16:38.910Z",
  "executiveSummary": "The su-exec utility, in versions through 0.3, contains a critical vulnerability stemming from improper validation of numeric user and group identifiers. By supplying identifiers that exceed the maximum capacity of the uid_t and gid_t data types, an attacker can trigger integer truncation. This process causes large numeric inputs to wrap around to zero, which corresponds to the root user/group. Consequently, a process intended to run with unprivileged permissions is instead executed with full root privileges. This vulnerability allows for unauthorized privilege escalation, posing a significant security risk to any system relying on su-exec for process isolation or restricted command execution. Successful exploitation does not require complex prerequisites, as an attacker only needs the ability to supply arguments to the su-exec binary. The impact is a complete compromise of the intended process's security boundary, potentially leading to full system compromise depending on the context of the executed command.",
  "technicalDetails": "The vulnerability resides in the core identifier parsing logic of su-exec, which utilizes the strtol function to process user-provided UID and GID inputs. The implementation fails to perform range validation (e.g., checking against UID_MAX or GID_MAX) prior to casting the resultant long integer to the target types uid_t and gid_t. In many C environments, these types are defined as unsigned 32-bit integers, whereas strtol processes signed long values. When an attacker provides a numeric string representing a value outside the representable range of these types, the subsequent assignment operation triggers an implicit integer truncation. Because of the behavior of unsigned integer overflow and narrowing casts, a sufficiently large value is truncated to a lower-order bit pattern that results in zero.\nThe attack flow follows a predictable sequence: First, the attacker identifies a target command typically executed via su-exec to drop privileges. Second, the attacker supplies a crafted numeric string as the user/group argument. For instance, passing a value such as 4294967296 (2^32) for a UID on systems where uid_t is 32-bit causes the value to truncate to 0. When su-exec calls setuid(0) or setgid(0) following this truncation, the kernel interprets the request as an attempt to switch to the root user identity. Because su-exec is typically installed with the SUID bit set or is being executed by a privileged context, the setuid/setgid calls succeed. The targeted program is subsequently spawned with root authority instead of the intended unprivileged context, effectively bypassing the intended security mechanism of the utility.\nThis behavior affects all versions up to and including 0.3. The flaw is not dependent on network exposure, as it occurs locally when a process is spawned. The attack does not require authentication to the su-exec binary itself; it requires only that the attacker has the ability to pass parameters to the process execution chain. Post-exploitation, the attacker gains the effective UID/GID of the root user, allowing the execution of arbitrary commands with full administrative system privileges. The lack of bounds checking before type casting represents a fundamental logic error in the handling of process identity transitions."
}