CVE-2026-91142

Executive Summary

CVE-2026-91142 is an integer overflow flaw in the do_lastlog() function of Cockpit, a web-based server administration interface. On ILP32 (32-bit) builds, the offset calculation used to locate lastlog entries can wrap when processing a specially provisioned, unusually large User ID (UID), allowing a low-privileged authenticated user to read and write lastlog records belonging to other accounts. The impact is limited but real: disclosure or tampering with login accounting data for other users on the same host.

Technical Analysis

Cockpit exposes a web-based management interface (conventionally reachable on TCP/9090) that allows authenticated, often low-privileged accounts to interact with system services, including reading user login accounting from the lastlog database. The lastlog database is a fixed-record binary file: each user's last-login record is stored in a slot whose position is derived by multiplying the UID by the size of one record and adding that product to a base offset.

The vulnerability class is an integer overflow (CWE-787 — Out-of-bounds Write, with an associated out-of-bounds read) in the offset arithmetic of the do_lastlog() function. On ILP32 builds — platforms where int, long, and pointer types are all 32 bits wide (e.g., 32-bit x86/ARM userlands) — the multiply-and-add used to compute a record offset can exceed the range of the integer type used for the calculation. When a UID large enough to drive the product past that limit is supplied, the offset value wraps to a small, unrelated position within or before the record array.

Because the wrapped offset still points into the mapped lastlog data (or an adjacent region), a subsequent read or write to that computed location is not bounds-checked against the intended user's slot. This means operations that should be scoped to the caller's own record instead address another user's record.

Three conditions must hold for exploitation:

1. ILP32 build. The flaw is specific to builds where the relevant integer type is 32 bits. On LP64 (64-bit) builds the arithmetic has enough headroom and the overflow does not occur. This significantly narrows the affected population.
2. A provisioned large UID. The attacker account must have a UID large enough to trigger the wrap. The NVD description states this UID is "specially provisioned," implying an administrator or provisioning system must have created the account; a default low UID will not suffice. This also means an attacker cannot simply pick an arbitrary UID — it must exist on the host.
3. Authenticated access. The user must be a valid, authenticated, low-privileged Cockpit user. There is no unauthenticated path described.

The attack surface is therefore local/adjacent in effect (CVSS AV:L): the exploit is driven through an authenticated interface rather than a remote, unauthenticated network request. The CVSS vector (AC:H, PR:L, UI:N) reflects that exploitation requires knowledge of the platform (ILP32) and the presence of a suitable large UID, but needs no user interaction once those preconditions are met. Both confidentiality (C:L) and integrity (I:L) impacts are low, and there is no availability impact (A:N) — consistent with being able to touch only a few adjacent records rather than corrupting the file wholesale.

Note on classification: CWE-787 describes the write side of the flaw. The advisory also explicitly credits unauthorized reads of other users' lastlog records, which corresponds to out-of-bounds read behavior. Insufficient technical detail is available on the exact integer type, the record stride/size, and the precise wrap threshold; these must not be assumed. What is unambiguous from the description is the mechanism: 32-bit offset arithmetic in do_lastlog() wraps for large UIDs, and the wrapped offset escapes the caller's record boundary.

Exploitation Scenarios

No public proof-of-concept, Nuclei template, or exploit code is available for CVE-2026-91142, and the flaw is unpatched. The following chain is inferred strictly from the vulnerability class and the NVD description; no specific internal function names, endpoints, or parameters beyond do_lastlog() and "lastlog entries" are asserted.

Step 1 — Reconnaissance / target identification. The attacker identifies hosts running a 32-bit (ILP32) Cockpit build. This can be inferred from architecture banners, package metadata, or access to the host itself. ILP32 platforms are the gating precondition; 64-bit deployments are not exploitable via this path.

Step 2 — Precondition satisfaction. The attacker needs (a) an authenticated account on the target and (b) an account with a "specially provisioned large UID." Scenario A: a provisioning or automation system on the host has assigned large UIDs to unprivileged service or tenant accounts, and the attacker holds one such account. Scenario B: the attacker has any means to influence UID assignment (for example, in a multi-tenant or orchestration context) so that a large UID is allocated to their own account.

Step 3 — Triggering the integer overflow. Through Cockpit's authenticated interface, the attacker performs a lastlog accounting read/operation while logged in as the large-UID account. In do_lastlog(), the offset for the caller's record is computed by multiplying the UID by the record size and adding a base offset. With a large-enough 32-bit UID, this product overflows and the result wraps to a different location. The operation then proceeds against the wrapped offset rather than the attacker's own slot.

Step 4 — Unauthorized read/write of adjacent records. Because the wrapped offset lands on another user's lastlog slot, the read discloses that user's login accounting information (last login time and origin), and the write can alter it. This is the core impact: cross-user disclosure and modification of login records. It is not described as leading to code execution, privilege escalation, or denial of service.

Step 5 — Post-exploitation. The attacker obtains login-accounting intelligence for other users of the same host and can corrupt it — a plausible precursor to further targeting or to covering tracks in an environment where lastlog data is trusted for auditing. There is no described lateral-movement or RCE primitive. Absent a public exploit, weaponization is currently theoretical.

Impact Assessment

• Confidentiality (Low): Disclosure of other users' login accounting records — last-login timestamps and origins. Sensitive for operational security and user-location inference, but not credential material.
• Integrity (Low): Ability to alter other users' lastlog records, degrading the reliability of login auditing on the host.
• Availability (None): No crash, corruption of the whole database, or service outage is described.
• Privileges Required (Low): An authenticated low-privileged account plus a specially provisioned large UID.
• Attack Complexity (High): Requires an ILP32 build and a suitable large UID; exploitation is platform- and configuration-conditional.
• Scope (Unchanged): Impact stays within the host's user-accounting boundary.

Blast radius: confined to hosts running 32-bit Cockpit builds that provision large UIDs. LP64 environments are unaffected by this specific code path, greatly limiting the population at risk. The absence of a public exploit, no CISA KEV listing, and an uncomputed EPSS score indicate low observed exploitation activity to date. The strategic value to an attacker is auditing-integrity manipulation rather than a direct path to system compromise.

Detection Guidance

Detection must focus on the preconditions (ILP32 builds, large UIDs, lastlog access) rather than a known payload string, since no PoC exists. Rules below are therefore behavioral and correlate the large-UID precondition with lastlog access.

Sigma Rule

title: Suspicious lastlog Access by High-UID Account (CVE-2026-91142 precondition)
id: 9f2c1a44-7b3e-4d21-9c88-cve202691142
status: experimental
description: Detects access/read of the lastlog database by a process running under an unusually large UID, consistent with the ILP32 offset-overflow precondition in Cockpit do_lastlog().
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-91142
author: valtersit.com Threat Intelligence
date: 2026/01/01
logsource:
  product: linux
  category: process_creation
detection:
  selection_lastlog:
    CommandLine|contains:
      - 'lastlog'
      - '/var/log/lastlog'
  selection_highuid:
    User|re: '^[0-9]{6,}$'
  condition: selection_lastlog and selection_highuid
falsepositives:
  - Legitimate audits run by high-UID administrative accounts
  - Provisioning scripts enumerating lastlog on ILP32 hosts
level: medium
tags:
  - attack.t1068
  - cve.2026.91142

YARA Rule

rule CVE_2026_91142_Cockpit_Lastlog_LargeUID
{
    meta:
        description = "Detects references to lastlog offset handling by large UID in Cockpit-related binaries or scripts (heuristic; no public PoC)"
        author = "valtersit.com Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-91142"
        date = "2026-01-01"
        cve = "CVE-2026-91142"
        severity = "low"

    strings:
        $fn   = "do_lastlog" ascii wide
        $ll   = "lastlog" ascii nocase
        $path = "/var/log/lastlog" ascii wide

    condition:
        uint16(0) == 0x5A4D or       // PE
        uint32(0) == 0x464C457F      // ELF
        and filesize < 50MB
        and $fn
        and any of ($ll, $path)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-91142 Cockpit lastlog large-UID offset manipulation attempt"; flow:to_server,established; http.uri; content:"cockpit"; http.header; content:"Cookie"; content:"lastlog"; nocase; threshold: type both, track by_src, count 5, seconds 60; classtype:attempted-user; reference:cve,2026-91142; sid:9001142; rev:1;)

Elastic Detection

sequence by host.id, user.id with maxspan=5m
  [ process where event.type == "start" and process.name in ("cockpit-bridge","cockpit-ws") and user.id : "1000000" ]
  [ file where event.category == "file" and file.path == "/var/log/lastlog" and event.action in ("read","write","open") ]

Splunk SPL Query

index=linux sourcetype=auditd OR sourcetype=syslog
| eval uid=coalesce(auid, uid, user)
| where match(uid, "^[0-9]{6,}$")
| search ("lastlog" OR "cockpit" OR "do_lastlog")
| stats count min(_time) as first_seen max(_time) as last_seen values(process) as procs by host uid
| where count >= 1
| sort - count

Wazuh OSSEC Rule

<group name="cockpit,cve-2026-91142,">
  <rule id="100142" level="8">
    <decoded_as>json</decoded_as>
    <field name="audit.key">lastlog</field>
    <description>CVE-2026-91142: lastlog access by high-UID account - possible Cockpit offset-overflow exploitation precondition.</description>
    <mitre>
      <id>T1068</id>
    </mitre>
    <group>attack,cve_2026_91142,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No vendor fix, fixed version, advisory, or tracked patch source exists for CVE-2026-91142 at this time. Treat all deployed ILP32 Cockpit instances as vulnerable.

1) Immediate mitigations

• Move to LP64 (64-bit) builds. Because the flaw is specific to ILP32, migrating Cockpit to a 64-bit userland removes the exploitable condition. This is the most reliable interim control.
• Constrain UID ranges. Ensure no accounts are provisioned with UIDs near the 32-bit wrap threshold. Audit /etc/passwd and directory-service UID allocations for exceptionally large UIDs and reassign them where feasible.
• Reduce authenticated exposure. Limit Cockpit access to trusted administrators; disable or restrict low-privileged accounts where the interface is not required. Enforce network-level access control on the Cockpit management port.
• File protections. Restrict read/write access to the lastlog database and monitor for unexpected modification. Consider reducing retention of sensitive login-accounting data where operationally acceptable.

2) Patch / upgrade steps

• Monitor the Cockpit project's release notes and CVE advisories for a fixed version addressing the do_lastlog() offset calculation. No fixed version is currently identified (affected versions list is empty).
• On availability of a patch, upgrade Cockpit and its dependencies on all ILP32 hosts, then verify the offset arithmetic no longer wraps for large UIDs.
• If no patch is obtainable, apply the LP64 migration in (1) as the definitive remediation.

3) Long-term hardening

• Track architecture inventory: identify and decommission ILP32 systems where 64-bit alternatives exist. Reduces exposure not only to this CVE but to the broader class of 32-bit integer-overflow defects.
• Enforce safe integer-arithmetic coding standards and bounds checks on offset calculations for external index values (UIDs, IDs) in internal code reviews.
• Centralize and integrity-protect login-accounting data so that in-place tampering is detectable.
• Subscribe to vendor and NVD feeds; this CVE is unpatched, so continuous monitoring for a fix is required.

References

1. NVD — CVE-2026-91142: https://nvd.nist.gov/vuln/detail/CVE-2026-91142
2. MITRE CWE-787 — Out-of-bounds Write: https://cwe.mitre.org/data/definitions/787.html
3. Cockpit Project (official site / release notes): https://cockpit-project.org/
4. CISA Known Exploited Vulnerabilities Catalog (verify current status; CVE-2026-91142 is not listed as of publication): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
5. FIRST EPSS (score not yet available at publication): https://www.first.org/epss/

Threat actor / exploit-in-the-wild evidence: None. No public PoC, exploit code, Nuclei template, or threat-actor campaign is associated with CVE-2026-91142. The flaw is unpatched and its exploitation remains theoretical, gated by the ILP32 and large-UID preconditions described above.