Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2023-22809: Sudo lets local user add files and gain rights

CVE-2023-22809 · published 3 years ago

Summary

The sudo command on Linux systems (versions 1.8.0 through 1.9.12p1) can be tricked by a user’s own editor settings to process extra files. An attacker with local access could cause sudo to edit files they choose, potentially giving them higher privileges. Update sudo to a version newer than 1.9.12p2 or apply the vendor’s patch to stop this behavior.

What to do

Update debian sudo to version 1.9.12p2-1.
Update sudo to version 1.9.12_p2-r0.
Update sudo_project sudo to version 1.9.12 or later.
Update apple macos to version 13.4 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
Debian:12	debian	sudo	< 1.9.12p2-1 Fix: upgrade to 1.9.12p2-1
Debian:13	debian	sudo	< 1.9.12p2-1 Fix: upgrade to 1.9.12p2-1
Debian:14	debian	sudo	< 1.9.12p2-1 Fix: upgrade to 1.9.12p2-1
Alpine:v3.14	–	sudo	>= 1.8.0, < 1.9.12_p2-r0 Fix: upgrade to 1.9.12_p2-r0
–	sudo_project	sudo	>= 1.8.0, < 1.9.12 1.9.12 `cpe:2.3:a:sudo_project:sudo::::::::`
–	debian	debian_linux	10.0 11.0 `cpe:2.3:o:debian:debian_linux:10.0:::::::*`
–	fedoraproject	fedora	36 37 `cpe:2.3:o:fedoraproject:fedora:36:::::::*`
–	apple	macos	< 13.4 `cpe:2.3:o:apple:macos::::::::`

Original advisory text

In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environment variables (SUDO_EDITOR, VISUAL, and EDITOR), allowing a local attacker to append arbitrary entries to the list of files to process. This can lead to privilege escalation. Affected versions are 1.8.0 through 1.9.12.p1. The problem exists because a user-specified editor may contain a "--" argument that defeats a protection mechanism, e.g., an EDITOR='vim -- /path/to/extra/file' value.

References

https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/22xxx/CVE-2023-22809... Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro... Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-22809 Vendor Advisory
https://security.gentoo.org/glsa/202305-12 Vendor Advisory
https://security.netapp.com/advisory/ntap-20230127-0015/ Vendor Advisory
https://www.debian.org/security/2023/dsa-5321 Vendor Advisory
https://www.sudo.ws/security/advisories/sudoedit_any/ Vendor Advisory
http://seclists.org/fulldisclosure/2023/Aug/21 Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/01/19/1 Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/01/msg00012.html Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2023-22809 Vendor Advisory
https://security.alpinelinux.org/vuln/CVE-2023-22809 Vendor Advisory
http://packetstormsecurity.com/files/171644/sudo-1.9.12p1-Privilege-Escalation.h... URL
http://packetstormsecurity.com/files/172509/Sudoedit-Extra-Arguments-Privilege-E... URL
http://packetstormsecurity.com/files/174234/Cisco-ThousandEyes-Enterprise-Agent-... URL
https://support.apple.com/kb/HT213758 URL
https://www.synacktiv.com/sites/default/files/2023-01/sudo-CVE-2023-22809.pdf URL

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

7.8 High

Exploitation

55% chance of attack within 30 days

Type

CWE-269Improper Privilege Management

Timeline

Published18 Jan 2023

Updated21 Oct 2026

First seen15 Sep 2026

Sources

DEBIAN-CVE-2023-22809 · OSV

ALPINE-CVE-2023-22809 · OSV

CVE-2023-22809 · NVD

CVE-2023-22809 · OSV

Track software like this

Free during beta