CVE-2023-29383

An attacker with local access can inject control characters (e.g., `\r`) and Unicode characters into fields processed by the SUID program `chfn`. Although `\n` is blocked, `\r` is not, allowing the attacker to manipulate the visual output of `/etc/passwd` when viewed with `cat`. By crafting a field that uses `\r` to overwrite portions of the line and Unicode to bypass the `:` character block, the attacker can make it appear that a rogue user account has been added. This is a social-engineering vector: a system administrator seeing the manipulated output may be convinced to take the system offline, resulting in an indirect denial of service [ref_id=1].

The vulnerability resides in the `valid_field` function in Shadow's source code, which is used by the SUID program `chfn` (change finger). The function was intended to scan fields for non-printable and illegal characters but did not check for control characters such as `\r` (carriage return). The patch modifies `valid_field` to also reject control characters via `iscntrl()` [ref_id=1].

The patch adds a check for control characters using `iscntrl(*cp)` in the `valid_field` function. Previously, the function only checked for non-printable characters via `isprint()`, which allowed control characters like `\r` to pass through. The new logic returns `-1` (illegal) when a control character is detected, rather than just `1` (non-printable but allowed). This closes the injection vector by rejecting any field containing control characters before it can be written to `/etc/passwd` [ref_id=1].

No public PoC is included in the bundle.