Several Linux distros have issued updates to fix a vulnerability in Sudo, a Linux app behind the “sudo” command, which can allow an unprivileged attacker to gain root privileges.
The issue, tracked as CVE-2017-1000367, came to light two days ago when security researchers from Qualys published an advisory on the matter.
Researchers say that an attacker that is in the position to run bash commands can create malformed sudo commands that will allow him to overwrite any file on the system, even root-owned content. In other words, the attacker gains the root-level privileges.
Only systems with Sudo and SELinux are vulnerable
The issue doesn’t affect all Linux distros, but only where the SELinux is enabled, and sudo was built with SELinux support.
Todd C. Miller, the creator of the Sudo app, has acknowledged the issue and released an update. The vulnerability was fixed in sudo 1.8.20p1. Sudo versions between 1.8.6p7 and 1.8.20 are affected.
Sudo is bundled as a default app in many of today’s Linux distros. Red Hat, SUSE, Debian, and Ubuntu have released urgent security updates to address the issue.
Below is Qualys’ technical explanation for the flaw. Proof-of-concept exploit code is available in the company’s original advisory, here.
We discovered a vulnerability in Sudo's get_process_ttyname() for Linux:
this function opens "/proc/[pid]/stat" (man proc) and reads the device
number of the tty from field 7 (tty_nr). Unfortunately, these fields are
space-separated and field 2 (comm, the filename of the command) can
contain spaces (CVE-2017-1000367).
For example, if we execute Sudo through the symlink "./ 1 ",
get_process_ttyname() calls sudo_ttyname_dev() to search for the
non-existent tty device number "1" in the built-in search_devs[].
Next, sudo_ttyname_dev() calls the function sudo_ttyname_scan() to
search for this non-existent tty device number "1" in a breadth-first
traversal of "/dev".
Last, we exploit this function during its traversal of the
world-writable "/dev/shm": through this vulnerability, a local user can
pretend that his tty is any character device on the filesystem, and
after two race conditions, he can pretend that his tty is any file on
the filesystem.
On an SELinux-enabled system, if a user is Sudoer for a command that
does not grant him full root privileges, he can overwrite any file on
the filesystem (including root-owned files) with his command's output,
because relabel_tty() (in src/selinux.c) calls open(O_RDWR|O_NONBLOCK)
on his tty and dup2()s it to the command's stdin, stdout, and stderr.
This allows any Sudoer user to obtain full root privileges.Source:https://www.bleepingcomputer.com/news/security/linux-distros-patch-dangerous-vulnerability-in-sudo-command/
Working as a cyber security solutions architect, Alisa focuses on application and network security. Before joining us she held a cyber security researcher positions within a variety of cyber security start-ups. She also experience in different industry domains like finance, healthcare and consumer products.
