Skip to content

Commit a684482

Browse files
squellsquell
committed
update sudo-cve text
1 parent 5bcad63 commit a684482

File tree

1 file changed

+18
-8
lines changed

1 file changed

+18
-8
lines changed

‎docs/sudo-cve.md‎

Lines changed: 18 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -14,10 +14,13 @@ These CVEs/advisories are possibly relevant to sudo-rs:
1414
| - [^rust] | | https://www.sudo.ws/security/advisories/heap_corruption/ |
1515
| CVE-2002-0184 [^rust] | | https://www.sudo.ws/security/advisories/prompt/ |
1616
| CVE-2004-1051 [^4] | | https://www.sudo.ws/security/advisories/bash_functions/ |
17+
| CVE-2004-1689 [^22] | | https://www.sudo.ws/security/advisories/sudoedit/ |
1718
| CVE-2005-1119 [^5] | | Corrupt arbitrary files via a symlink attack |
1819
| CVE-2005-1993 [^6] | | https://www.sudo.ws/security/advisories/path_race/ |
1920
| CVE-2005-4890 [^7] | | TTY hijacking when a privileged user uses sudo to run unprivileged commands |
2021
| - [^9] | | https://www.sudo.ws/security/advisories/cmnd_alias_negation/ |
22+
| CVE-2010-0426 [^23] | | https://www.sudo.ws/security/advisories/sudoedit_escalate/ |
23+
| CVE-2010-1163 [^23] | | https://www.sudo.ws/security/advisories/sudoedit_escalate2/ |
2124
| CVE-2010-1646 [^10] | | https://www.sudo.ws/security/advisories/secure_path/ |
2225
| CVE-2010-2956 [^11] | | https://www.sudo.ws/security/advisories/runas_group/ |
2326
| CVE-2011-0010 [^12] | | https://www.sudo.ws/security/advisories/runas_group_pw/ |
@@ -27,11 +30,15 @@ These CVEs/advisories are possibly relevant to sudo-rs:
2730
| CVE-2013-2776 [^15] | | https://www.sudo.ws/security/advisories/tty_tickets/ |
2831
| CVE-2013-2777 [^15] | | https://www.sudo.ws/security/advisories/tty_tickets/ |
2932
| CVE-2014-9680 [^16] | | https://www.sudo.ws/security/advisories/tz/ |
33+
| CVE-2015-5602 [^24] | | https://bugzilla.sudo.ws/show_bug.cgi?id=707 |
3034
| CVE-2016-7032 [^17] | | https://www.sudo.ws/security/advisories/noexec_bypass/ |
3135
| CVE-2016-7076 [^17] | | https://www.sudo.ws/security/advisories/noexec_wordexp/ |
3236
| CVE-2017-1000367 [^18] | | https://www.sudo.ws/security/advisories/linux_tty/ |
3337
| CVE-2017-1000368 [^18] | | https://www.sudo.ws/security/advisories/linux_tty/ |
3438
| CVE-2019-18634 [^rust] | | https://www.sudo.ws/security/advisories/pwfeedback/ |
39+
| CVE-2021-3156 [^21] | | https://www.sudo.ws/security/advisories/unescape_overflow/ |
40+
| CVE-2021-23239 [^25] | | https://www.sudo.ws/releases/stable/#1.9.5 |
41+
| CVE-2023-22809 [^20] | | https://www.sudo.ws/security/advisories/sudoedit_any/ |
3542
| CVE-2023-28486 [^19] | | Syslog messages do not escape control characters |
3643

3744
[^1]: All our path checks should only ever be done with absolute paths
@@ -55,6 +62,16 @@ These CVEs/advisories are possibly relevant to sudo-rs:
5562
[^17]: Sudo-rs uses seccomp filtering rather than libc function interception through LD_PRELOAD.
5663
[^18]: -
5764
[^19]: -
65+
[^20]: Sudo-rs doesn't use a "stringly typed" interface between the execution and policy modules.
66+
[^21]: Rust memory safety should prevent this, sudo-rs doesn't allow `-s` and `-e` to be combined, and sudo-rs
67+
doesn't "unescape" program arguments in the sudoers module
68+
[^22]: Reading the changed temporary file back is done by an unprivileged helper process.
69+
[^23]: Sudo-rs matches commands based on (canonicalized and absolute) path names, so `sudoedit` never matches; furthermore,
70+
an attempt to run `sudo /path/to/sudoedit` will be interpreted as running `sudoedit`.
71+
[^24]: Sudo-rs doesn't allow wildcards or symlinks in configuration arguments to sudoedit, and checks that all path
72+
components are not writable by the calling user.
73+
[^25]: Sudo-rs opens all components of the path to be edited exactly once, and checks that all path components are
74+
not writable by the calling user.
5875

5976
## Non-applicable CVEs
6077

@@ -67,26 +84,19 @@ relevant at that time.
6784
| CVE | Reason |
6885
| -------------- | ----------------------------------------------------------------------------------------------------------- |
6986
| CVE-2002-0043 | mail functionality is not implemented, https://www.sudo.ws/security/advisories/postfix/ |
70-
| CVE-2004-1689 | `sudoedit`/`sudo -e` is not implemented, https://www.sudo.ws/security/advisories/sudoedit/ |
7187
| CVE-2005-2959 | env_reset is always enabled / blacklist is not supported, https://www.sudo.ws/security/advisories/bash_env/ |
7288
| CVE-2005-4158 | env_reset is always enabled / blacklist is not supported, https://www.sudo.ws/security/advisories/perl_env/ |
7389
| CVE-2006-0151 | env_reset is always enabled / blacklist is not supported |
7490
| CVE-2007-3149 | Kerberos functionality is not implemented, https://www.sudo.ws/security/advisories/kerberos5/ |
7591
| CVE-2009-0034 | The group matching logic does not have this bug, https://www.sudo.ws/security/advisories/group_vector/ |
76-
| CVE-2010-0426 | `sudoedit`/`sudo -e` is not implemented, https://www.sudo.ws/security/advisories/sudoedit_escalate/ |
7792
| CVE-2010-0427 | runas_default is not implemented |
78-
| CVE-2010-1163 | `sudoedit`/`sudo -e` is not implemented, https://www.sudo.ws/security/advisories/sudoedit_escalate2/ |
7993
| CVE-2012-2337 | No host ip-based rule matching is currently implemented, https://www.sudo.ws/security/advisories/netmask/ |
8094
| CVE-2012-3440 | Related to Red Hat specific script and not sudo directly |
8195
| CVE-2014-0106 | Disabling env_reset is not supported, https://www.sudo.ws/security/advisories/env_add/ |
82-
| CVE-2015-5602 | `sudoedit`/`sudo -e` is not implemented |
8396
| CVE-2015-8239 | The sha2 digest feature is not implemented |
8497
| CVE-2019-14287 | This bug is not present, https://www.sudo.ws/security/advisories/minus_1_uid/ |
85-
| CVE-2021-3156 | `sudoedit`/`sudo -e` is not implemented, https://www.sudo.ws/security/advisories/unescape_overflow/ |
86-
| CVE-2021-23239 | `sudoedit`/`sudo -e` is not implemented |
87-
| CVE-2021-23240 | `sudoedit`/`sudo -e` is not implemented, https://www.sudo.ws/security/advisories/sudoedit_selinux/ |
98+
| CVE-2021-23240 | sudo-rs does not have SELinux support, https://www.sudo.ws/security/advisories/sudoedit_selinux/ |
8899
| CVE-2022-43995 | crypt/password backend is not implemented, only PAM |
89-
| CVE-2023-22809 | `sudoedit`/`sudo -e` is not implemented, https://www.sudo.ws/security/advisories/sudoedit_any/ |
90100
| CVE-2023-27320 | The chroot functionality is not implemented, https://www.sudo.ws/security/advisories/double_free/ |
91101
| CVE-2023-28487 | Sudoreplay is not implemented |
92102
| CVE-2025-32462 | `sudo -h` is not implemented, https://www.sudo.ws/security/advisories/host_any/ |

0 commit comments

Comments
 (0)