REDHAT-BUG-2525889: High severity Sudo Sudo vulnerability
Sudo through 1.9.17p2 fails to apply intercept policy checks to the execveat system call in ptrace-based intercept mode. Users permitted to run specific commands can execute denied programs by calling execveat directly or through fexecve, bypassing policy enforcement and logging.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this bypass?
Deployments using Sudo in ptrace-based intercept mode are affected. The issue applies through Sudo 1.9.17p2 and affects users who are allowed to run specific commands under an intercept policy.
What does an attacker need to exploit the issue?
An attacker needs permission to run specific commands through Sudo. They can then invoke execveat directly, or invoke it through fexecve, to run programs that the intercept policy would otherwise deny.
What is the impact of successful exploitation?
The attacker can bypass intercept policy enforcement and logging for the executed program. This allows execution of denied programs despite restrictions intended to limit which commands the user may run.