A vulnerability in Sudo that allows privilege escalation using specific rules.

In the utility Sudo, used to facilitate command execution on behalf of other users, identified vulnerability (CVE-2019-14287), which allows commands to be executed with root privileges, provided that there are sudoers settings where an explicit prohibition on running as root ("… (ALL, !root) …") follows the permissive keyword "ALL" in the user ID check section. In default configurations of distributions, the vulnerability does not manifest.

If there are permissible but very rarely encountered rules in sudoers that allow execution of a specific command under the UID of any user except root, an attacker with permissions to execute that command can bypass the established restriction and run the command as root. To bypass the restriction, it is sufficient to attempt executing the specified command in the settings with UID "-1" or "4294967295", which will cause it to execute with UID 0.

For example, if there is a rule in the settings that allows any user to execute the program /usr/bin/id under any UID:

myhost ALL = (ALL, !root) /usr/bin/id

or an option that allows execution only for the specific user bob:

myhost bob = (ALL, !root) /usr/bin/id

The user can execute "sudo -u ‘#-1’ id" and the utility /usr/bin/id will be run with root privileges despite the explicit prohibition in the settings. The issue arises from overlooking the special values "-1" or "4294967295", which do not change the UID, but since sudo itself is already running as root, the target command also executes with root privileges without changing the UID.

In SUSE and openSUSE distributions, without specifying "NOPASSWD" in the rule, the vulnerability is not exploitable, as the sudoers by default includes the "Defaults targetpw" mode, where the UID check is performed against the password database, prompting for the target user's password. For such systems, the attack can only be executed if there are rules like:

myhost ALL = (ALL, !root) NOPASSWD: /usr/bin/id

The issue has been resolved in the release Sudo 1.8.28. The fix is also available in the form of a patch. In the distributions, the vulnerability has already been addressed in Debian, Arch Linux, Arch, Ubuntu, Gentoo and FreeBSD. At the time of writing, the issue remains unpatched in SUSE/openSUSE and Alpine. The vulnerability was identified by security researchers from Apple.

Source: opennet.ru