CVE-2015-8239: Race Condition
A vulnerability in functionality for adding support of SHA-2 digests along with the command was found. The sudoers plugin performs this digest verification while matching rules, and later independently calls execve() to execute the binary. This results in a race condition if the digest functionality is used as suggested (in fact, the rules are matched before the user is prompted for a password, so there is not negligible time frame to replace the binary from underneath sudo). Versions affected are since 1.8.7.
CVE assignment:
http://seclists.org/oss-sec/2015/q4/327
Other sources
The SHA-2 digest support in the sudoers plugin in sudo after 1.8.7 allows local users with write permissions to parts of the called command to replace them before it is executed.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2015-8239?
CVE-2015-8239 is considered to have a high severity due to its potential exploitation leading to privilege escalation.
How do I fix CVE-2015-8239?
To fix CVE-2015-8239, you should update to a patched version of sudo, ideally version 1.8.10 or later.
What versions of sudo are affected by CVE-2015-8239?
CVE-2015-8239 affects sudo versions 1.8.8 through 1.8.14, including specific build variants.
What is the nature of the vulnerability in CVE-2015-8239?
CVE-2015-8239 involves a race condition in the digest verification process used in the sudoers plugin.
Is there a workaround for CVE-2015-8239 if I cannot update immediately?
A potential workaround is to limit permissions for the affected binaries until an update can be applied.