Bug 1915053 (CVE-2021-23240)
| Summary: | CVE-2021-23240 sudo: symbolic link attack in SELinux-enabled sudoedit | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Pedro Sampaio <psampaio> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | alakatos, dapospis, kzak, mattdm, rik.theys, rsroka, zfridric |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | sudo 1.9.5 | Doc Type: | If docs needed, set a value |
| Doc Text: |
A race condition vulnerability was found in the temporary file handling of sudoedit's SELinux RBAC support. On systems where SELinux is enabled, this flaw allows a malicious user with sudoedit permissions to set the owner of an arbitrary file to the user ID of the target user, potentially leading to local privilege escalation. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2021-05-18 14:37:42 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1927461, 1915054, 1917038, 1917039 | ||
| Bug Blocks: | 1915059 | ||
|
Description
Pedro Sampaio
2021-01-11 20:30:00 UTC
Created sudo tracking bugs for this issue: Affects: fedora-all [bug 1915054] External References: https://www.sudo.ws/alerts/sudoedit_selinux.html Upstream fix: https://www.sudo.ws/repos/sudo/rev/8fcb36ef422a Several conditions are necessary to exploit this bug: - sudo is built with SELinux support - either SELinux is in permissive mode or the invoking user is in an unconfined domain - the "protected symlinks" feature is disabled (/proc/sys/fs/protected_symlinks set to 0) Mitigation: * Enable SELinux in enforcing mode. * Enable the symbolic link protection (/proc/sys/fs/protected_symlinks set to 1). * Remove the `sesh` binary (/usr/libexec/sudo/sesh or /usr/lib/sudo/sesh) if SELinux RBAC support is not needed. The versions of sudo as shipped with Red Hat Enterprise Linux 7 and 8 are built with `--with-selinux` compilation flag. However, SELinux enforcing mode is the default and recommended mode of operation in Red Hat Enterprise Linux 7 and 8. Additionally, both Red Hat Enterprise Linux 7 and 8 have the symlinks protection turned on by default, thus preventing this bug from being exploited. [1] https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/using_selinux/getting-started-with-selinux_using-selinux#selinux-states-and-modes_getting-started-with-selinux [2] https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html-single/security_guide/index#sec-Protecting_Hard_and_Symbolic_Links Statement: SELinux enforcing mode is the default and recommended mode of operation in Red Hat Enterprise Linux. Moreover, the symbolic link protection is enabled by default, thus preventing this issue from being exploited. Therefore, this flaw has been rated as having a security impact of Low for Red Hat Enterprise Linux. This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2021:1723 https://access.redhat.com/errata/RHSA-2021:1723 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2021-23240 |