In the utility , used to facilitate command execution on behalf of other users, vulnerability (), allowing users to escalate their privileges to root. The issue manifests starting from sudo version 1.7.1 only when using the "pwfeedback" option in the /etc/sudoers file, which is disabled by default but enabled in some distributions such as Linux Mint and Elementary OS. The issue was addressed in the release , published a few hours ago. The vulnerability remains unpatched in these distributions.
The "pwfeedback" option enables the display of a "*" symbol after each entered character when typing a password. Due to the implementation of the getln() function defined in the tgetpass.c file, a string with an excessive length passed through standard input (stdin) may not fit in the allocated buffer under certain conditions, leading to overwriting other data on the stack. The overflow occurs during the execution of sudo code with root privileges.
The essence of the problem is that when using the special character ^U (clearing the line) during input and when a write operation fails, the code responsible for clearing the output symbols "*" resets the available buffer size data but fails to reset the pointer to the current position in the buffer. Another contributing factor to exploitation is the lack of automatic disabling of the "pwfeedback" mode when data is delivered not from the terminal but through the input stream (this oversight allows for conditions that can lead to a write error, for example, on systems with unidirectional the error occurs when attempting to write past the end of the reading pipe).
Since the attacker can fully control the overwriting of data on the stack, it is not difficult to create an exploit that allows privilege escalation to root. The issue can be exploited by any user, regardless of their sudo usage rights and any user-specific configurations in sudoers. To mitigate the issue, ensure that the "pwfeedback" setting is absent in /etc/sudoers and disable it if necessary ("Defaults !pwfeedback"). To check for the issue, the following code can be executed:
$ perl -e 'print(("A" x 100 . "\x{00}") x 50)' | sudo -S id
Password: Segmentation fault
Source: opennet.ru
