Title: EGI SVG 'ADVISORY' [TLP:WHITE] CRITICAL risk - sudo privilege
escalation vulnerability CVE-2021-3156. [EGI-SVG-CVE-2021-3156]
Date: 2021-01-27
Updated:
Affected software and risk
==========================
CRITICAL risk vulnerability concerning sudo
Package : sudo
CVE ID : CVE-2021-3156
A local privilege escalation vulnerability has been disclosed [R 1][R 2] in the
sudo package in versions prior to the patched versions referenced below.
Actions required
================
Sites are required immediately to update the packages or apply the mitigation
described below to all user-accessible systems; these include in particular WNs
and UIs.
All running resources MUST be either patched or have mitigation in place or
software removed by 2021-02-04T00:00+00
Sites failing to act and/or failing to respond to requests from the EGI CSIRT
team risk site suspension.
Component installation information
==================================
Patches are available directly from vendor repos; see [R 3-7]
Details of patched versions for RedHat distributions are:
RHEL/CentOS7: sudo-1.8.23-10.el7_9.1
RHEL/CentOS8: sudo-1.8.29-6.el8_3.1
For other distributions see the links referenced below.
Mitigation
==========
If an update is not possible, for example for unsupported operating systems
pending migration, sites are required to implement one of the following
mitigations (in order of preference):
*If sudo is not actively used:*
* Remove it from their systems (yum remove sudo)
* Remove the SUID bit on the binary (chmod u-s /usr/bin/sudo) or
* Remove the execution bit on the binary (chmod go-x /usr/bin/sudo).
*If sudo is actively used:*
* Apply the systemtap script mentioned in [R 2], after every boot of the
system.
* Change the access (access bits & acls) on /usr/bin/sudo to restrict it to a
smaller set of users/group.
Please note that these last two mitigations *will not be accepted* as a long
term solution for this vulnerability, i.e. updates are required.
Affected software details
=========================
All versions of sudo prior to the patched versions are understood to be
vulnerable.
More information
================
A heap-based buffer overflow was found in the way sudo parses command line
arguments. This flaw is exploitable by any local user (normal users and system
users, sudoers and non-sudoers), without authentication (i.e., the attacker
does not need to know the user's password). Successful exploitation of this
flaw could lead to privilege escalation. [R 2]
TLP and URL
===========
** WHITE information - Unlimited distribution - see
https://go.egi.eu/tlp for distribution restrictions **
URL: https://advisories.egi.eu/Advisory-SVG-CVE-2021-3156
Minor updates may be made without re-distribution to the sites
Comments
========
Comments or questions should be sent to svg-rat at mailman.egi.eu
If you find or become aware of another vulnerability which is relevant to EGI
you may report it by e-mail to
report-vulnerability at egi.eu
the EGI Software Vulnerability Group will take a look according to the
procedure defined in [R 8]
Note that this is undergoing revision to fully handle vulnerabilities in the
EOSC-hub era.
References
==========
[R 1] https://seclists.org/oss-sec/2021/q1/71
[R 2] https://access.redhat.com/security/cve/CVE-2021-3156
[R 3] https://access.redhat.com/errata/RHSA-2021:0221 (RHEL7)
[R 4] https://access.redhat.com/errata/RHSA-2021:0218 (RHEL8)
[R 5] https://lists.centos.org/pipermail/centos-announce/2021-January/048252.html
(CentOS 7)
[R 6] https://ubuntu.com/security/CVE-2021-3156 (Ubuntu)
[R 7] https://security-tracker.debian.org/tracker/CVE-2021-3156 (Debian)
[R 8] https://documents.egi.eu/public/ShowDocument?docid=3145
Credit
======
SVG was alerted to this vulnerability by Tobias Dussa.
Timeline
========
Yyyy-mm-dd [EGI-SVG-CVE-2021-3156]
2021-01-26 Vulnerability reported by Tobias Dussa
2021-01-26 Acknowledgement from the EGI SVG to the reporter
2021-01-27 EGI SVG Risk Assessment completed
2021-01-27 Updated packages available
2021-01-27 Advisory/Alert sent to sites
Context
=======
This advisory has been prepared as part of the effort to fulfil EGI SVG's
purpose "To minimize the risk to the EGI infrastructure arising from software
vulnerabilities"
The risk is that assessed by the group, according to the EGI SVG issue handling
procedure [R 8] in the context of how the software is used in the EGI
infrastructure. It is the opinion of the group, we do not guarantee it to be
correct. The risk may also be higher or lower in other deployments depending on
how the software is used.
Others may re-use this information provided they:-
1) Respect the provided TLP classification
2) Credit the EGI https://www.egi.eu/ Software Vulnerability Group
Note that the SVG issue handling procedure is currently under review, to take
account of the increasing inhomogeneity of the EGI infrastructure and the
services in the EOSC-hub catalogue.
On behalf of the EGI SVG,
David Crooks
EGI CSIRT Security Officer On Duty