Bugzilla – Bug 955994
VUL-0: CVE-2015-8239: sudo: Race condition when checking digests in sudoers
Last modified: 2017-06-13 14:38:28 UTC
rh#1283635 A vulnerability in functionality for adding support of SHA-2 digests along with the command was found. The sudoers plugin performs this digest verification while matching rules, and later independently calls execve() to execute the binary. This results in a race condition if the digest functionality is used as suggested (in fact, the rules are matched before the user is prompted for a password, so there is not negligible time frame to replace the binary from underneath sudo). Versions affected are since 1.8.7. References: https://bugzilla.redhat.com/show_bug.cgi?id=1283635 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8239 http://seclists.org/oss-sec/2015/q4/327 http://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-8239.html http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8239
bugbot adjusting priority
There is a running update for this issue but according to upstream hg and changelog there doesn't seem to be any patch yet. I suggest to wait for the upstream to fix this properly (it appears that the fix won't be a trivial one).
There are some changes in upstream regarding this issue. They added the support for using fexecve() and warning in the documentation that it's not safe if the user has a write access to the command itself. - https://www.sudo.ws/repos/sudo/rev/397722cdd7ec - https://www.sudo.ws/repos/sudo/rev/0cd3cc8fa195 The problem is, that this is not a proper solution. Please see comment 7 in the RH Bugzilla [1] for more information. It seems that upstream considers this issue closed. [1] https://bugzilla.redhat.com/show_bug.cgi?id=1283635
I have to agree that it would be better to document that allowing sudo of binaries in user writable directories should be avoided, as it is hard to make safe. (And I do not see this as a common use case.)
bin/addnote CVE-2015-8239 "This issue is only a problem if you allow sudo of specific binaries in user writable locations (and checking them with SHA2 digests). This scenario does not seem common, and we recommend not to allow sudo executing specific binaries in userwritable locations." for cve page
will not be fixed code wise.