Vulnerability · Published Jan 18, 2023 · Assigned by mitre
CVE-2023-22809
High 7.8
In plain English
A high-severity privilege mismanagement in the sudo package (AlmaLinux). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 55.4% (higher than 99.0% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environment variables (SUDO_EDITOR, VISUAL, and EDITOR), allowing a local attacker to append arbitrary entries to the list of files to process. This can lead to privilege escalation. Affected versions are 1.8.0 through 1.9.12.p1. The problem exists because a user-specified editor may contain a "--" argument that defeats a protection mechanism, e.g., an EDITOR='vim -- /path/to/extra/file' value.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | sudo | 1.8.29-8.el8_7.1 | ALSA-2023:0284 |
| AlmaLinux:9 | sudo | 1.9.5p2-7.el9_1.1 | ALSA-2023:0282 |
| AlmaLinux:9 | sudo-python-plugin | 1.9.5p2-7.el9_1.1 | ALSA-2023:0282 |
| Alpine:v3.20 | sudo | 1.9.12_p2-r0 | ALPINE-CVE-2023-22809 |
| Alpine:v3.21 | sudo | 1.9.12_p2-r0 | ALPINE-CVE-2023-22809 |
| Alpine:v3.22 | sudo | 1.9.12_p2-r0 | ALPINE-CVE-2023-22809 |
| Alpine:v3.23 | sudo | 1.9.12_p2-r0 | ALPINE-CVE-2023-22809 |
| Alpine:v3.24 | sudo | 1.9.12_p2-r0 | ALPINE-CVE-2023-22809 |
| Debian:12 | sudo | 1.9.12p2-1 | DEBIAN-CVE-2023-22809 |
| Debian:13 | sudo | 1.9.12p2-1 | DEBIAN-CVE-2023-22809 |
| Debian:14 | sudo | 1.9.12p2-1 | DEBIAN-CVE-2023-22809 |
| Rocky Linux:8 | sudo | 0:1.8.29-8.el8_7.1 | RLSA-2023:0284 |
| Rocky Linux:9 | sudo | 0:1.9.5p2-7.el9_1.1 | RLSA-2023:0282 |
| Ubuntu:22.04:LTS | sudo | 1.9.9-1ubuntu2.2 | UBUNTU-CVE-2023-22809 |
| Ubuntu:22.04:LTS | sudo | 1.9.9-1ubuntu2.2 | USN-5811-1 |
Affected products (as reported)
Weakness: CWE-269 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://www.synacktiv.com/sites/default/files/2023-01/sudo-CVE-2023-22809.pdf
- https://www.sudo.ws/security/advisories/sudoedit_any/
- [debian-lts-announce] 20230118 [SECURITY] [DLA 3272-1] sudo security update mailing-list
- DSA-5321 vendor-advisory
- [oss-security] 20230119 CVE-2023-22809: Sudoedit can edit arbitrary files mailing-list
- FEDORA-2023-9078f609e6 vendor-advisory
- https://security.netapp.com/advisory/ntap-20230127-0015/
- FEDORA-2023-298c136eee vendor-advisory
- http://packetstormsecurity.com/files/171644/sudo-1.9.12p1-Privilege-Escalation.html
- GLSA-202305-12 vendor-advisory
- https://support.apple.com/kb/HT213758
- http://packetstormsecurity.com/files/172509/Sudoedit-Extra-Arguments-Privilege-Escalation.html
- 20230817 KL-001-2023-003: Cisco ThousandEyes Enterprise Agent Virtual Appliance Arbitrary File Modification via sudoedit mailing-list
- http://packetstormsecurity.com/files/174234/Cisco-ThousandEyes-Enterprise-Agent-Virtual-Appliance-Arbitrary-File-Modification.html