CVE-2019-18684: Race Condition
First published: Mon Nov 04 2019(Updated: )
** DISPUTED ** Sudo through 1.8.29 allows local users to escalate to root if they have write access to file descriptor 3 of the sudo process. This occurs because of a race condition between determining a uid, and the setresuid and openat system calls. The attacker can write "ALL ALL=(ALL) NOPASSWD:ALL" to /proc/#####/fd/3 at a time when Sudo is prompting for a password. NOTE: This has been disputed due to the way Linux /proc works. It has been argued that writing to /proc/#####/fd/3 would only be viable if you had permission to write to /etc/sudoers. Even with write permission to /proc/#####/fd/3, it would not help you write to /etc/sudoers.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Sudo | <=1.8.29 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2019-18684.
What is the severity level of CVE-2019-18684?
The severity level of CVE-2019-18684 is high.
What is the affected software?
The affected software is Sudo Project Sudo version 1.8.29.
How can local users escalate to root using this vulnerability?
Local users can escalate to root by having write access to file descriptor 3 of the sudo process.
Is there a fix available for this vulnerability?
Please refer to the provided reference for information on any available fixes for CVE-2019-18684.
- agent/type
- agent/severity
- agent/weakness
- agent/references
- agent/author
- agent/status
- agent/softwarecombine
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- status/disputed
- vendor/sudo project
- canonical/sudo
- version/sudo/1.8.29