sudo up to 1.8.6 sudoers /var/db/sudo/lectured race condition

Summaryinfo

A vulnerability, which was classified as problematic, has been found in sudo up to 1.8.6. The affected element is an unknown function of the file /var/db/sudo/lectured of the component sudoers. Performing a manipulation results in race condition. This vulnerability is cataloged as CVE-2015-8239. The attack must be initiated from a local position. There is no exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in sudo up to 1.8.6 (Operating System Utility Software). It has been classified as problematic. This affects an unknown functionality of the file /var/db/sudo/lectured of the component sudoers. The manipulation with an unknown input leads to a race condition vulnerability. CWE is classifying the issue as CWE-362. The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

The SHA-2 digest support in the sudoers plugin in sudo after 1.8.7 allows local users with write permissions to parts of the called command to replace them before it is executed.

The bug was discovered 10/10/2015. The weakness was shared 10/10/2017 (oss-sec). It is possible to read the advisory at openwall.com. This vulnerability is uniquely identified as CVE-2015-8239 since 11/18/2015. Attacking locally is a requirement. The successful exploitation needs a authentication. Technical details of the vulnerability are known, but there is no available exploit.

The vulnerability was handled as a non-public zero-day exploit for at least 279 days. During that time the estimated underground price was around $0-$5k. The vulnerability scanner Nessus provides a plugin with the ID 92331 (Fedora 22 : sudo (2016-90836ca57d)), which helps to determine the existence of the flaw in a target environment. It is assigned to the family Fedora Local Security Checks and running in the context l.

Upgrading to version 1.8.7 eliminates this vulnerability. A possible mitigation has been published before and not just after the disclosure of the vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (92331). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Operating System Utility Software

Name

• sudo

Version

• 1.8.0
• 1.8.1
• 1.8.2
• 1.8.3
• 1.8.4
• 1.8.5
• 1.8.6

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion