Time-of-check vs time-of-use issue in sudoedit allows local privilege escalation

Summary

Users that are explicitly permitted to edit only specific files using sudoedit, are still able to place files in arbitrary directories.

Impact

This only affects systems where sudoedit is used to give very fine-grained edit permissions, which is not the default configuration. For users that have full sudoedit permission or no sudoedit permission at all, no escalation is enabled by this bug.

A user that is allowed to place files in an arbitrary directory can (by placing a file in /etc/sudoers.d) obviously fully escalate their privileges.

Versions affected

sudoedit was added in version 0.2.8. sudo-rs versions 0.2.7 and earlier are not affected. This bug is fixed in sudo-rs 0.2.15.

Example

Suppose /etc/sudoers contains the following:

user ALL=sudoedit /etc/hosts

Then, if user runs a process that creates a symbolic link that rapidly alternates between pointing to /etc and the target directory of interest, eventually a sudoedit link/hosts command will succeed in allowing an edit to a file named hosts in that directory instead of /etc.

Background

Dealing with symbolic links and components of a path under the control of the invoking user is a known challenge for privilege escalation tools such as sudo. For sudoedit, sudo-rs performs thorough checks such as canonicalizing paths, checking that all path-components cannot be altered by the user, and prohibiting the editing of symbolic links. After a path is sanitized, it is check…