Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Sudoedit can edit arbitrary files

seclists.org

Post reply on HN
Print view View original

1–10 of 61 posts

Re: Sudoedit can edit arbitrary files

#4

Post by nequo »

syrrim wrote: post #2

Is there a patch, or more detailed explanation of what causes this?

Ubuntu shipped the patch three days ago. The output of `apt changelog sudo` on 22.04 LTS:

  sudo (1.9.9-1ubuntu2.2) jammy-security; urgency=medium

    * SECURITY UPDATE: arbitrary file overwrite via sudoedit
      - debian/patches/CVE-2023-22809.patch: do not permit editor arguments
        to include -- in plugins/sudoers/editor.c, plugins/sudoers/sudoers.c,
        plugins/sudoers/visudo.c.
      - CVE-2023-22809
    * SECURITY UPDATE: DoS via invalid arithmetic shift in Protobuf-c
      - debian/patches/CVE-2022-33070.patch: only shift unsigned values in
        lib/protobuf-c/protobuf-c.c.
      - CVE-2022-33070

   -- Marc Deslauriers   Mon, 16 Jan 2023 07:36:33 -0500
There is a detailed explanation on the sudo website: https://www.sudo.ws/security/advisories/sudoedit_any/

Re: Sudoedit can edit arbitrary files

#5

Post by stabbles »

I wonder if this bug in logic (instead of buffer overflows) would also have been less likely in a different language. Would it have been more obvious in a language where it's easier to work with dynamically allocated arrays and strings?

Re: Sudoedit can edit arbitrary files

#6

Post by mattpallissard »

stabbles wrote: post #5

I wonder if this bug in logic (instead of buffer overflows) would also have been less likely in a different language. Would it have been more obvious in a language where it's easier to work with dynamically allocated arrays and strings?

Doubtful, failing to sanitize your inputs plagues memory safe languages too.

Re: Sudoedit can edit arbitrary files

#7

Post by dllthomas »

stabbles wrote: post #5

I wonder if this bug in logic (instead of buffer overflows) would also have been less likely in a different language. Would it have been more obvious in a language where it's easier to work with dynamically allocated arrays and strings?

I don't see a change to language, per se, that would have helped, really.

A system with more of an object capabilities model could have helped, though. The goal wasn't really "let the user run their editor as root (when they ask for it)", but "let the user work with this particular file from their editor (when they ask for it)".

Re: Sudoedit can edit arbitrary files

#8

Post by JoshTriplett »

stabbles wrote: post #5

I wonder if this bug in logic (instead of buffer overflows) would also have been less likely in a different language. Would it have been more obvious in a language where it's easier to work with dynamically allocated arrays and strings?

With my Rust hat on: I don't think that Rust would have solved this. It might have made the code in question easier to understand, as you note, but this kind of error can still happen in any language.

Re: Sudoedit can edit arbitrary files

#10

Post by jboy55 »

dejj wrote: post #9

Why is this a problem, given that one can easily use sudoedit for privilege escalation already? edit: I now realize I have confused sudoedit with visudo

I read it at first take as if it was "CVE-2023-32049: 'su' has critical privilege escalation venerability"
Post reply on HN