0

On Linux Mint 20.1 Ulyssa, I have received a security update to patch tow security flaws leading to a local privilege escalation without password for all unpatched sudo version before 1.9.5 version and here is a part of the change log:

sudo (1.8.31-1ubuntu1.2) focal-security; urgency=medium

  * SECURITY UPDATE: dir existence issue via sudoedit race
    - debian/patches/CVE-2021-23239.patch: fix potential directory existing
      info leak in sudoedit in src/sudo_edit.c.
    - CVE-2021-23239
  * SECURITY UPDATE: heap-based buffer overflow
    - debian/patches/CVE-2021-3156-pre1.patch: sanity check size when
      converting the first record to TS_LOCKEXCL in
      plugins/sudoers/timestamp.c.
    - debian/patches/CVE-2021-3156-1.patch: reset valid_flags to
      MODE_NONINTERACTIVE for sudoedit in src/parse_args.c.
    - debian/patches/CVE-2021-3156-2.patch: add sudoedit flag checks in
      plugin in plugins/sudoers/policy.c.
    - debian/patches/CVE-2021-3156-3.patch: fix potential buffer overflow
      when unescaping backslashes in plugins/sudoers/sudoers.c.
    - debian/patches/CVE-2021-3156-4.patch: fix the memset offset when
      converting a v1 timestamp to TS_LOCKEXCL in
      plugins/sudoers/timestamp.c.
    - debian/patches/CVE-2021-3156-5.patch: don't assume that argv is
      allocated as a single flat buffer in src/parse_args.c.
    - CVE-2021-3156

 -- Marc Deslauriers <m[email protected]>  Tue, 19 Jan 2021 09:21:02 -0500

But on debian Buster I have received only one update for sudo package.

On debian sudo --version : 1.8.27-1+deb10u3

but on linux mint: sudo --version : 1.8.31-1ubuntu1.2

Sudo versions affected:

Sudo versions 1.8.2 through 1.8.31p2 and 1.9.0 through 1.9.5p1 are affected.

qualys security paper:

Successful exploitation of this vulnerability allows any unprivileged user to gain root privileges on the vulnerable host. Qualys security researchers have been able to independently verify the vulnerability and develop multiple variants of exploit and obtain full root privileges on Ubuntu 20.04 (Sudo 1.8.31), Debian 10 (Sudo 1.8.27), and Fedora 33 (Sudo 1.9.2). Other operating systems and distributions are also likely to be exploitable.

Until a security update will be uploaded, is there any way to harden debian to avoid exploiting the 2 security flaws CVE-2021-23239 and CVE-2021-3156?

Improve this question
2
  • 1
    Red Hat documentation has mitigations for both for RHEL, but I have no idea if these can be also applied on Debian, but it might be worth trying. It's enabling symlink protection for CVE-2021-23239 and a systemtap script for CVE-2021-3156.
    – Vojtech Trefny
    Jan 26, 2021 at 21:26
  • The security update for buster is already out. Do apt update and you should see it, unless your mirror is very slow to update (in which case change your mirror to deb http://deb.debian.org/debian-security buster/updates main)
    – grifferz
    Jan 26, 2021 at 21:43

1 Answer 1

Reset to default
5

CVE-2021-3156 is fixed by sudo 1.8.27-1+deb10u3.

Both CVE-2021-23239 and CVE-2021-23240 are mitigated by fs.protected_symlinks, which is set to 1 by default in Debian 10: this setting only allows symlinks to be followed if they are outside a sticky world-writable directory (such as /tmp), or when the uid of the symlink and follower match, or when the directory owner matches the symlink’s owner. CVE-2021-23240 additionally only affects systems using SELinux, which isn’t the default in Debian.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .