Описание
selinux_edit_copy_tfiles in sudoedit in Sudo before 1.9.5 allows a local unprivileged user to gain file ownership and escalate privileges by replacing a temporary file with a symlink to an arbitrary file target. This affects SELinux RBAC support in permissive mode. Machines without SELinux are not vulnerable.
A race condition vulnerability was found in the temporary file handling of sudoedit's SELinux RBAC support. On systems where SELinux is enabled, this flaw allows a malicious user with sudoedit permissions to set the owner of an arbitrary file to the user ID of the target user, potentially leading to local privilege escalation. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Отчет
SELinux enforcing mode is the default and recommended mode of operation in Red Hat Enterprise Linux. Moreover, the symbolic link protection is enabled by default, thus preventing this issue from being exploited. Therefore, this flaw has been rated as having a security impact of Low for Red Hat Enterprise Linux.
Меры по смягчению последствий
- Enable SELinux in enforcing mode.
- Enable the symbolic link protection (/proc/sys/fs/protected_symlinks set to 1).
- Remove the
seshbinary (/usr/libexec/sudo/sesh or /usr/lib/sudo/sesh) if SELinux RBAC support is not needed.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 5 | sudo | Out of support scope | ||
| Red Hat Enterprise Linux 6 | sudo | Out of support scope | ||
| Red Hat Enterprise Linux 7 | sudo | Out of support scope | ||
| Red Hat Enterprise Linux 9 | sudo | Not affected | ||
| Red Hat Enterprise Linux 8 | sudo | Fixed | RHSA-2021:1723 | 18.05.2021 |
Показывать по
Дополнительная информация
Статус:
EPSS
7.8 High
CVSS3
Связанные уязвимости
selinux_edit_copy_tfiles in sudoedit in Sudo before 1.9.5 allows a local unprivileged user to gain file ownership and escalate privileges by replacing a temporary file with a symlink to an arbitrary file target. This affects SELinux RBAC support in permissive mode. Machines without SELinux are not vulnerable.
selinux_edit_copy_tfiles in sudoedit in Sudo before 1.9.5 allows a local unprivileged user to gain file ownership and escalate privileges by replacing a temporary file with a symlink to an arbitrary file target. This affects SELinux RBAC support in permissive mode. Machines without SELinux are not vulnerable.
selinux_edit_copy_tfiles in sudoedit in Sudo before 1.9.5 allows a local unprivileged user to gain file ownership and escalate privileges by replacing a temporary file with a symlink to an arbitrary file target. This affects SELinux RBAC support in permissive mode. Machines without SELinux are not vulnerable.
selinux_edit_copy_tfiles in sudoedit in Sudo before 1.9.5 allows a loc ...
selinux_edit_copy_tfiles in sudoedit in Sudo before 1.9.5 allows a local unprivileged user to gain file ownership and escalate privileges by replacing a temporary file with a symlink to an arbitrary file target. This affects SELinux RBAC support in permissive mode. Machines without SELinux are not vulnerable.
EPSS
7.8 High
CVSS3