Bug 2115789

+++ This bug was initially created as a clone of Bug #2114576 +++

Flagging as a security issue because it relates to sudo/authentication/privileged access.

Description of problem:
The sudoers file can be used to store the SHA2 hash of an executable, along with the users (or groups) permitted to execute it. This hash is used by sudo to verify whether the binary has been modified/tampered, and if so, users are prevented from exexuting it.

However, the digest is calculated incorrectly for SHA384 and SHA512 functions with files that are sized
   (n*8) mod 1024 == 896
where n is the file size in bytes.

This causes sudo to falsely prevent the execution of unmodified files.

Version-Release number of selected component:
sudo-1.9.5p2-7.el9.x86_64

How reproducible:
  - Every time, as long as the file size matches the criteria above.

Steps to Reproduce:
# As root, create a 240 byte test executable:
dd if=/dev/zero of=/opt/testexec bs=1 count=240 iflag=fullblock && chmod 744 /opt/testexec
# Add a new user:
adduser testusr
# Create a digest entry in sudoers:
echo "testusr ALL=(ALL) NOPASSWD: sha512:$(sha512sum /opt/testexec | awk '{ print $1 }') /opt/testexec *" > /etc/sudoers.d/testdigest
# Attempt to execute the application as the "testusr" user:
sudo -u testusr sudo /opt/testexec

Actual results:
  User prompted for password (if logging is enabled, a "sha512 digest mismatch" error is reported in /var/log/sudo_debug.log)

Expected results:
  User is authorized to execute file without password prompt, which is what happens if the file is 239 or 241 bytes long.