A significant vulnerability has been identified in the Linux operating system, potentially allowing a low-privilege attacker to gain complete root access to affected systems. This flaw, known as CVE-2017-1000367, was uncovered by researchers at Qualys Security within Sudo’s “get_process_ttyname()” function, which could enable users with Sudo privileges to execute commands as the root user, effectively escalating their privileges.
Sudo, short for “superuser do!,” is a critical utility in Linux and UNIX environments that enables standard users to perform specific high-privileged tasks, such as user management and system updates. The vulnerability stems from the way Sudo processes “tty” information sourced from the process status file in the proc filesystem. According to Qualys Security, Sudo parses the /proc/[pid]/stat file to ascertain the device number of the process’s tty through field 7 (tty_nr).
Although the file’s fields are space-separated, field 2 (the command name) can include whitespace, including newline characters, a nuance that Sudo fails to adequately address. Consequently, a local user with Sudo permissions in a SELinux-enabled environment could manipulate the device number utilized by Sudo. This exploitation is achieved by creating a symbolic link from the Sudo binary to a name that contains a space followed by a number, which could enable the attacker to overwrite arbitrary files on the filesystem, including those owned by root.
A detailed advisory from the Sudo project illustrates how attackers can leverage this vulnerability. If the attacker selects a non-existent device number under /dev, and Sudo does not locate the terminal in the /dev/pts directory, it performs a breadth-first scan of /dev. The attacker may then craft a symbolic link to this newly created device in a world-writable directory like /dev/shm. This link could then serve as the command’s standard input, output, and error stream, enabling potentially destructive actions like overwriting crucial files such as /etc/shadow or /etc/sudoers.
The vulnerability, affecting Sudo versions from 1.8.6p7 to 1.8.20 and classified as high severity, has already been addressed in the latest release, Sudo 1.8.20p1. Organizations using Sudo are strongly advised to update their systems promptly to mitigate any risk associated with this flaw.
In recent developments, Red Hat has released patches for Red Hat Enterprise Linux 6, 7, and Server versions, while Debian has issued updates for its Wheezy, Jessie, and Sid releases. Additionally, SUSE Linux has also implemented fixes across a range of its products. Qualys Security has indicated that it intends to release details regarding the Sudoer-to-root exploit once a sufficient number of users have secured their systems.
In the context of the MITRE ATT&CK framework, this vulnerability aligns primarily with tactics such as privilege escalation and initial access, where an authorized user exploits weaknesses in the Sudo mechanism to gain heightened access privileges. The potential for significant damage underscores the importance of maintaining up-to-date system software and implementing best practices in access management to safeguard against these vulnerabilities.