Local Directory Manipulation Vulnerability in Sudo Package
Summary
ALPINE-CVE-2021-23239: The sudoedit personality of Sudo before 1.9.5 may allow a local unprivileged user to perform arbitrary directory-existence tests by winning a sudo_edit.c race condition in replacing a user-controlled directory by a symli... Affects sudo versions < 1.9.5p2-r0. Fixed in 1.9.5p2-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Sudo package is a widely used utility in Unix-like operating systems that allows a permitted user to execute a command as the superuser or another user, as specified by the security policy. Sudo is essential for managing permissions and enhancing security by allowing controlled access to system commands. However, certain versions of Sudo are vulnerable to a race condition that can be exploited by local unprivileged users, potentially leading to unauthorized access or manipulation of directories.
Vulnerability Detail
The vulnerability, identified as CVE-2021-23239, exists in the sudoedit personality of Sudo versions prior to 1.9.5. It allows a local unprivileged user to perform arbitrary directory-existence tests by exploiting a race condition in the sudo_edit.c file. This could enable the attacker to replace a user-controlled directory with a symlink to an arbitrary path, leading to potential unauthorized access to sensitive files or directories. The CVSS score for this vulnerability is 2.5, indicating a low severity but still a notable risk.
How To Fix
Minimum fixed version
1.9.5p2-r0
This is the first release that contains the fix.
sudo apk add --upgrade sudoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit the permissions of the sudoedit command or restrict access to the affected directories until the package is updated. This can be done by modifying the sudoers file to limit which users can execute sudoedit.
Conclusion
CVE-2021-23239 represents a significant vulnerability in the Sudo package that could allow local unprivileged users to manipulate directories through a race condition. It is crucial to update to the patched versions of Sudo to mitigate this risk. Users are encouraged to monitor their systems and apply the necessary updates promptly.
See every vulnerability recorded for sudo →
FAQ
CVE-2021-23239 is a vulnerability in the Sudo package that allows local unprivileged users to exploit a race condition, potentially leading to unauthorized directory manipulation.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
The CVSS score for CVE-2021-23239 is 2.5, indicating a low severity risk.
If immediate updates are not possible, consider restricting access to the sudoedit command and monitoring for any suspicious activity in your system.
You can visit the official Sudo website or security advisories for detailed information on vulnerabilities and patches.
References
Related vulnerabilities
Recent vulnerabilities recorded for sudo.
