REDHAT-BUG-2374693: High severity Sudo Sudo vulnerability
An attacker can leverage sudo's -R (--chroot) option to run arbitrary commands as root, even if they are not listed in the sudoers file. Sudo versions 1.9.14 to 1.9.17 inclusive are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.9.14 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.9.17 - Compensating control
Mitigate immediately by preventing use of sudo's -R/--chroot option for non-admin users (e.g., disallow/limit sudo execution paths that allow the -R/--chroot option).
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2374693?
The severity of REDHAT-BUG-2374693 is high due to the potential for attackers to execute arbitrary commands as root.
How do I fix REDHAT-BUG-2374693?
To fix REDHAT-BUG-2374693, upgrade sudo to version 1.9.18 or later.
Which versions of sudo are affected by REDHAT-BUG-2374693?
Sudo versions 1.9.14 to 1.9.17 inclusive are affected by REDHAT-BUG-2374693.
Can users not in the sudoers file exploit REDHAT-BUG-2374693?
Yes, users not listed in the sudoers file can exploit REDHAT-BUG-2374693 to execute arbitrary commands as root.
What functionality does the `-R` option in sudo relate to REDHAT-BUG-2374693?
The `-R` (or `--chroot`) option in sudo is exploited in REDHAT-BUG-2374693 to run commands as root without proper permissions.