Bug 1915053 (CVE-2021-23240) - CVE-2021-23240 sudo: symbolic link attack in SELinux-enabled sudoedit
Summary: CVE-2021-23240 sudo: symbolic link attack in SELinux-enabled sudoedit
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2021-23240
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1927461 1915054 1917038 1917039
Blocks: 1915059
TreeView+ depends on / blocked
 
Reported: 2021-01-11 20:30 UTC by Pedro Sampaio
Modified: 2021-05-18 14:37 UTC (History)
7 users (show)

Fixed In Version: sudo 1.9.5
Doc Type: If docs needed, set a value
Doc Text:
A race condition vulnerability was found in the temporary file handling of sudoedit's SELinux RBAC support. On systems where SELinux is enabled, this flaw allows a malicious user with sudoedit permissions to set the owner of an arbitrary file to the user ID of the target user, potentially leading to local privilege escalation. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Clone Of:
Environment:
Last Closed: 2021-05-18 14:37:42 UTC


Attachments (Terms of Use)

Description Pedro Sampaio 2021-01-11 20:30:00 UTC
A flaw in the temporary file handling of sudoedit's SELinux RBAC support was found in versions of sudo before 1.9.5.  On systems where SELinux is enabled, a user with sudoedit permissions may be able to set the owner of an arbitrary file to the user-ID of the target user.

Comment 1 Pedro Sampaio 2021-01-11 20:30:31 UTC
Created sudo tracking bugs for this issue:

Affects: fedora-all [bug 1915054]

Comment 2 Mauro Matteo Cascella 2021-01-14 19:16:50 UTC
External References:

https://www.sudo.ws/alerts/sudoedit_selinux.html

Comment 3 Mauro Matteo Cascella 2021-01-14 19:19:41 UTC
Upstream fix:
https://www.sudo.ws/repos/sudo/rev/8fcb36ef422a

Comment 5 Mauro Matteo Cascella 2021-01-16 18:05:54 UTC
Several conditions are necessary to exploit this bug:
- sudo is built with SELinux support
- either SELinux is in permissive mode or the invoking user is in an unconfined domain
- the "protected symlinks" feature is disabled (/proc/sys/fs/protected_symlinks set to 0)

Comment 6 Mauro Matteo Cascella 2021-01-16 18:14:32 UTC
Mitigation:

* Enable SELinux in enforcing mode.
* Enable the symbolic link protection (/proc/sys/fs/protected_symlinks set to 1).
* Remove the `sesh` binary (/usr/libexec/sudo/sesh or /usr/lib/sudo/sesh) if SELinux RBAC support is not needed.

Comment 7 Mauro Matteo Cascella 2021-01-16 18:34:33 UTC
The versions of sudo as shipped with Red Hat Enterprise Linux 7 and 8 are built with `--with-selinux` compilation flag. However, SELinux enforcing mode is the default and recommended mode of operation in Red Hat Enterprise Linux 7 and 8. Additionally, both Red Hat Enterprise Linux 7 and 8 have the symlinks protection turned on by default, thus preventing this bug from being exploited.

[1] https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/using_selinux/getting-started-with-selinux_using-selinux#selinux-states-and-modes_getting-started-with-selinux
[2] https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html-single/security_guide/index#sec-Protecting_Hard_and_Symbolic_Links

Comment 9 Mauro Matteo Cascella 2021-01-18 11:05:21 UTC
Statement:

SELinux enforcing mode is the default and recommended mode of operation in Red Hat Enterprise Linux. Moreover, the symbolic link protection is enabled by default, thus preventing this issue from being exploited. Therefore, this flaw has been rated as having a security impact of Low for Red Hat Enterprise Linux.

Comment 14 errata-xmlrpc 2021-05-18 14:32:34 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:1723 https://access.redhat.com/errata/RHSA-2021:1723

Comment 15 Product Security DevOps Team 2021-05-18 14:37:42 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-23240


Note You need to log in before you can comment on or make changes to this bug.