CVE-2021-23240: High severity sudo vulnerability
selinuxeditcopytfiles in sudoedit in Sudo before 1.9.5 allows a local unprivileged user to gain file ownership and escalate privileges by replacing a temporary file with a symlink to an arbitrary file target. This affects SELinux RBAC support in permissive mode. Machines without SELinux are not vulnerable.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2021-23240?
CVE-2021-23240 is a vulnerability in sudoedit in Sudo before 1.9.5 that allows a local unprivileged user to gain file ownership and escalate privileges.
How does CVE-2021-23240 affect SELinux RBAC support in permissive mode?
CVE-2021-23240 affects SELinux RBAC support in permissive mode by allowing the user to replace a temporary file with a symlink to an arbitrary file target, gaining file ownership and escalating privileges.
Which versions of Sudo are affected by CVE-2021-23240?
Versions of Sudo before 1.9.5 are affected by CVE-2021-23240.
Are machines without SELinux affected by CVE-2021-23240?
Machines without SELinux are not affected by CVE-2021-23240.
What is the severity of CVE-2021-23240?
CVE-2021-23240 has a severity rating of 7.8 (high).
What is the Common Weakness Enumeration (CWE) ID for CVE-2021-23240?
The Common Weakness Enumeration (CWE) ID for CVE-2021-23240 is 59.
Where can I find more information about CVE-2021-23240?
You can find more information about CVE-2021-23240 at the following references: [1] [2] [3]