October 14, 2019
keyword in a Runas specification, it is possible to run commands as root by specifying the user ID -1 or 4294967295.
This can be used by a user with sufficient sudo privileges to run commands as root even if the Runas specification explicitly disallows root access as long as the ALL keyword is listed first in the Runas specification.
Log entries for commands run this way will list the target user as 4294967295 instead of root. In addition, PAM session modules will not be run for the command.
Sudo versions prior to 1.8.28 are affected.
in the Runas specifier.
Sudo supports running a command with a user-specified user name or user ID, if permitted by the sudoers policy. For example, the following sudoers entry allow the id command to be run as any user because it includes the ALL keyword in the Runas specifier.
myhost alice = (ALL) /usr/bin/idNot only is user
syntax, for example:
sudo -u#1234 id -uwould return 1234 . However, the setresuid(2) and setreuid(2)
system calls, which sudo uses to change the user ID before running the command, treat user ID -1 (or its unsigned equivalent 4294967295), specially and do not change the user ID for this value. As a result,
sudo -u#-1 id -u
sudo -u#4294967295 id -uwill actually return 0
. This is because the sudo command itself is already running as user ID 0 so when sudo tries to change to user ID -1, no change occurs.
This results in sudo log entries that report the command as being run by user ID 4294967295 and not root (or user ID 0). Additionally, because the user ID specified via the -u option does not exist in the password database, no PAM session modules will be run.
If a sudoers entry is written to allow the user to run a command as any user except root, the bug can be used to avoid this restriction. For example, given the following sudoers entry:
myhost bob = (ALL, !root) /usr/bin/viUser bob is allowed to run vi as any user but root. However, due to the bug, bob is actually able to run vi as root by running sudo -u#-1 vi
, violating the security policy.
Only sudoers entries where the ALL keyword is present in the Runas specifier are affected. For example, the following sudoers entry is unaffected:
myhost alice = /usr/bin/id
In this example, alice is only allowed to run the id command as root. Any attempt to run the command as a different user will be denied.
The bug is fixed in sudo 1.8.28.
Joe Vennix from Apple Information Security found and analyzed the bug.