Skip to content

Commit 73e6a53

Browse files
squellsquell
committed
update sudo-cve text
1 parent b57be94 commit 73e6a53

File tree

1 file changed

+15
-8
lines changed

1 file changed

+15
-8
lines changed

‎docs/sudo-cve.md

Lines changed: 15 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -14,10 +14,13 @@ These CVEs/advisories are possibly relevant to sudo-rs:
1414
| - [^rust] | | https://www.sudo.ws/security/advisories/heap_corruption/ |
1515
| CVE-2002-0184 [^rust] | | https://www.sudo.ws/security/advisories/prompt/ |
1616
| CVE-2004-1051 [^4] | | https://www.sudo.ws/security/advisories/bash_functions/ |
17+
| CVE-2004-1689 [^22] | | https://www.sudo.ws/security/advisories/sudoedit/ |
1718
| CVE-2005-1119 [^5] | | Corrupt arbitrary files via a symlink attack |
1819
| CVE-2005-1993 [^6] | | https://www.sudo.ws/security/advisories/path_race/ |
1920
| CVE-2005-4890 [^7] | | TTY hijacking when a privileged user uses sudo to run unprivileged commands |
2021
| - [^9] | | https://www.sudo.ws/security/advisories/cmnd_alias_negation/ |
22+
| CVE-2010-0426 [^23] | | https://www.sudo.ws/security/advisories/sudoedit_escalate/ |
23+
| CVE-2010-1163 [^23] | | https://www.sudo.ws/security/advisories/sudoedit_escalate2/ |
2124
| CVE-2010-1646 [^10] | | https://www.sudo.ws/security/advisories/secure_path/ |
2225
| CVE-2010-2956 [^11] | | https://www.sudo.ws/security/advisories/runas_group/ |
2326
| CVE-2011-0010 [^12] | | https://www.sudo.ws/security/advisories/runas_group_pw/ |
@@ -27,11 +30,15 @@ These CVEs/advisories are possibly relevant to sudo-rs:
2730
| CVE-2013-2776 [^15] | | https://www.sudo.ws/security/advisories/tty_tickets/ |
2831
| CVE-2013-2777 [^15] | | https://www.sudo.ws/security/advisories/tty_tickets/ |
2932
| CVE-2014-9680 [^16] | | https://www.sudo.ws/security/advisories/tz/ |
33+
| CVE-2015-5602 [^24] | | https://bugzilla.sudo.ws/show_bug.cgi?id=707 |
3034
| CVE-2016-7032 [^17] | | https://www.sudo.ws/security/advisories/noexec_bypass/ |
3135
| CVE-2016-7076 [^17] | | https://www.sudo.ws/security/advisories/noexec_wordexp/ |
3236
| CVE-2017-1000367 [^18] | | https://www.sudo.ws/security/advisories/linux_tty/ |
3337
| CVE-2017-1000368 [^18] | | https://www.sudo.ws/security/advisories/linux_tty/ |
3438
| CVE-2019-18634 [^rust] | | https://www.sudo.ws/security/advisories/pwfeedback/ |
39+
| CVE-2021-3156 [^21] | | https://www.sudo.ws/security/advisories/unescape_overflow/ |
40+
| CVE-2021-23239 [^25] | | https://www.sudo.ws/releases/stable/#1.9.5 |
41+
| CVE-2023-22809 [^20] | | https://www.sudo.ws/security/advisories/sudoedit_any/ |
3542
| CVE-2023-28486 [^19] | | Syslog messages do not escape control characters |
3643

3744
[^1]: All our path checks should only ever be done with absolute paths
@@ -55,6 +62,13 @@ These CVEs/advisories are possibly relevant to sudo-rs:
5562
[^17]: Sudo-rs uses seccomp filtering rather than libc function interception through LD_PRELOAD.
5663
[^18]: -
5764
[^19]: -
65+
[^20]: Sudo-rs doesn't use a "stringly typed" interface between the execution and policy modules.
66+
[^21]: Rust memory safety should prevent this, sudo-rs doesn't allow `-s` and `-e` to be combined, and sudo-rs
67+
doesn't "unescape" program arguments in the sudoers module
68+
[^22]: Sudo-rs uses sockets to communicate between the root process and the child process running the editor
69+
[^23]: Sudo-rs matched commands based on (canonicalized and resolved) path names, so `sudoedit` never matches.
70+
[^24]: Sudo-rs doesn't allow wildcards or symlinks in configuration arguments to sudoedit.
71+
[^25]: TODO (#1187)
5872

5973
## Non-applicable CVEs
6074

@@ -67,26 +81,19 @@ relevant at that time.
6781
| CVE | Reason |
6882
| -------------- | ----------------------------------------------------------------------------------------------------------- |
6983
| CVE-2002-0043 | mail functionality is not implemented, https://www.sudo.ws/security/advisories/postfix/ |
70-
| CVE-2004-1689 | `sudoedit`/`sudo -e` is not implemented, https://www.sudo.ws/security/advisories/sudoedit/ |
7184
| CVE-2005-2959 | env_reset is always enabled / blacklist is not supported, https://www.sudo.ws/security/advisories/bash_env/ |
7285
| CVE-2005-4158 | env_reset is always enabled / blacklist is not supported, https://www.sudo.ws/security/advisories/perl_env/ |
7386
| CVE-2006-0151 | env_reset is always enabled / blacklist is not supported |
7487
| CVE-2007-3149 | Kerberos functionality is not implemented, https://www.sudo.ws/security/advisories/kerberos5/ |
7588
| CVE-2009-0034 | The group matching logic does not have this bug, https://www.sudo.ws/security/advisories/group_vector/ |
76-
| CVE-2010-0426 | `sudoedit`/`sudo -e` is not implemented, https://www.sudo.ws/security/advisories/sudoedit_escalate/ |
7789
| CVE-2010-0427 | runas_default is not implemented |
78-
| CVE-2010-1163 | `sudoedit`/`sudo -e` is not implemented, https://www.sudo.ws/security/advisories/sudoedit_escalate2/ |
7990
| CVE-2012-2337 | No host ip-based rule matching is currently implemented, https://www.sudo.ws/security/advisories/netmask/ |
8091
| CVE-2012-3440 | Related to Red Hat specific script and not sudo directly |
8192
| CVE-2014-0106 | Disabling env_reset is not supported, https://www.sudo.ws/security/advisories/env_add/ |
82-
| CVE-2015-5602 | `sudoedit`/`sudo -e` is not implemented |
8393
| CVE-2015-8239 | The sha2 digest feature is not implemented |
8494
| CVE-2019-14287 | This bug is not present, https://www.sudo.ws/security/advisories/minus_1_uid/ |
85-
| CVE-2021-3156 | `sudoedit`/`sudo -e` is not implemented, https://www.sudo.ws/security/advisories/unescape_overflow/ |
86-
| CVE-2021-23239 | `sudoedit`/`sudo -e` is not implemented |
87-
| CVE-2021-23240 | `sudoedit`/`sudo -e` is not implemented, https://www.sudo.ws/security/advisories/sudoedit_selinux/ |
95+
| CVE-2021-23240 | sudo-rs does not have SELinux support, https://www.sudo.ws/security/advisories/sudoedit_selinux/ |
8896
| CVE-2022-43995 | crypt/password backend is not implemented, only PAM |
89-
| CVE-2023-22809 | `sudoedit`/`sudo -e` is not implemented, https://www.sudo.ws/security/advisories/sudoedit_any/ |
9097
| CVE-2023-27320 | The chroot functionality is not implemented, https://www.sudo.ws/security/advisories/double_free/ |
9198
| CVE-2023-28487 | Sudoreplay is not implemented |
9299

0 commit comments

Comments
 (0)