CVE-2023-22809 is a privilege escalation vulnerability in Sudo versions 1.8.0 through 1.9.12p1, affecting products like Apple, Debian, and Fedora. It allows a local attacker to append arbitrary files to the sudoedit process by manipulating environment variables, bypassing protection mechanisms. With a CVSS score of 7.8 (High), this flaw is easily exploitable with low attack complexity and no user interaction, leading to full confidentiality, integrity, and availability compromise. While not on CISA's KEV catalog, public exploit code exists in Metasploit and ExploitDB, and it has garnered significant community discussion and media coverage, indicating active awareness and potential for exploitation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 1.8.0, < 1.9.12CPE matchmatch criteria | cpe:2.3:a:sudo_project:sudo:*:*:*:*:*:*:*:* | ||
1.9.12CPE matchmatch criteria | cpe:2.3:a:sudo_project:sudo:1.9.12:-:*:*:*:*:*:* | ||
1.9.12CPE matchmatch criteria | cpe:2.3:a:sudo_project:sudo:1.9.12:p1:*:*:*:*:*:* | ||
10.0CPE matchmatch criteria | cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | ||
11.0CPE matchmatch criteria | cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
AS-2023-001: Sudo
Feb 20, 2023sudo: arbitrary file write with privileges of the RunAs user
Jan 18, 2023In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environment variables (SUDO_EDITOR, VISUAL, and EDITOR), allowing a local attacker to append arbitrary entries to the list of files to process. This can lead to privilege escalation. Affected versions are 1.8.0 through 1.9.12.p1. The problem exists because a user-specified editor may contain a "--" argument that defeats a protection mechanism, e.g., an EDITOR='vim -- /path/to/extra/file' value.
Jan 10, 2023