A flaw in the temporary file handling of sudoedit's SELinux RBAC support was found in versions of sudo before 1.9.5. On systems where SELinux is enabled, a user with sudoedit permissions may be able to set the owner of an arbitrary file to the user-ID of the target user.
Created sudo tracking bugs for this issue: Affects: fedora-all [bug 1915054]
External References: https://www.sudo.ws/alerts/sudoedit_selinux.html
Upstream fix: https://www.sudo.ws/repos/sudo/rev/8fcb36ef422a
Several conditions are necessary to exploit this bug: - sudo is built with SELinux support - either SELinux is in permissive mode or the invoking user is in an unconfined domain - the "protected symlinks" feature is disabled (/proc/sys/fs/protected_symlinks set to 0)
Mitigation: * Enable SELinux in enforcing mode. * Enable the symbolic link protection (/proc/sys/fs/protected_symlinks set to 1). * Remove the `sesh` binary (/usr/libexec/sudo/sesh or /usr/lib/sudo/sesh) if SELinux RBAC support is not needed.
The versions of sudo as shipped with Red Hat Enterprise Linux 7 and 8 are built with `--with-selinux` compilation flag. However, SELinux enforcing mode is the default and recommended mode of operation in Red Hat Enterprise Linux 7 and 8. Additionally, both Red Hat Enterprise Linux 7 and 8 have the symlinks protection turned on by default, thus preventing this bug from being exploited. [1] https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/using_selinux/getting-started-with-selinux_using-selinux#selinux-states-and-modes_getting-started-with-selinux [2] https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html-single/security_guide/index#sec-Protecting_Hard_and_Symbolic_Links
Statement: SELinux enforcing mode is the default and recommended mode of operation in Red Hat Enterprise Linux. Moreover, the symbolic link protection is enabled by default, thus preventing this issue from being exploited. Therefore, this flaw has been rated as having a security impact of Low for Red Hat Enterprise Linux.
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2021:1723 https://access.redhat.com/errata/RHSA-2021:1723
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2021-23240