KaraZajac
dd5f4fa06d
Second new module this cycle; sibling of sudo_chwoot (CVE-2025-32463, same Stratascale/Rich Mirch disclosure). sudo's -h/--host option — meant only to pair with -l/--list — was honored when running a command, so a sudoers rule scoped to a host other than the current machine (and not ALL) is usable via 'sudo -h <host> <cmd>' for local root. Affects sudo 1.8.8 -> 1.9.17p0; fixed 1.9.17p1. CWE-863, CVSS 8.8 (not in KEV). detect(): version-gate [1.8.8, 1.9.17p0] via ctx->host->sudo_version (the host-restricted rule itself isn't probeable unprivileged, so VULNERABLE means 'vulnerable sudo present'). exploit(): discovers an abusable host-restricted rule from readable sudoers (or SKELETONKEY_SUDO_HOST), witnesses with 'sudo -n -h <host> id -u', pops 'sudo -h <host> /bin/bash' (SKELETONKEY_SUDO_CMD) only on a uid-0 witness; honest EXPLOIT_FAIL + operator guidance otherwise. Shared 'sudo' family; structural, arch=any; safety rank 96. auditd/sigma/falco rules, NOTICE.md (Rich Mirch / Stratascale) + MODULE.md, 4 detect() test rows. Wiring: registry, Makefile, cve_metadata (+JSON), verify-vm/targets.yaml (ubuntu1804 sudo 1.8.21p2 target, sweep pending). Docs: README + CVES.md + docs/index.html counts 40->41 modules / 35->36 CVEs; not-yet-verified lists + corpus pill.
50 lines
2.3 KiB
Markdown
50 lines
2.3 KiB
Markdown
# NOTICE — sudo_host (CVE-2025-32462)
|
|
|
|
## Vulnerability
|
|
|
|
**CVE-2025-32462** — sudo's `-h`/`--host` option, intended only to be
|
|
used with `-l`/`--list` to display a user's privileges on a *different*
|
|
host, was also honored when actually running a command (or via
|
|
`sudoedit`). This lets a user evaluate the sudoers policy as though the
|
|
machine were some other host: a sudoers rule scoped to a host that is
|
|
neither the current machine nor `ALL` becomes usable locally via
|
|
`sudo -h <that-host> <command>`, yielding command execution as root.
|
|
|
|
Primarily affects sites that distribute one sudoers file across a fleet,
|
|
or use LDAP/SSSD-based sudoers, where host-restricted rules are common.
|
|
|
|
- Affected: sudo **1.8.8** through **1.9.17p0** (the `-h` behaviour is
|
|
~12 years old). Fixed in **1.9.17p1**.
|
|
- CWE-863 (Incorrect Authorization). CVSS 8.8 (High). Not in CISA KEV
|
|
(the sibling `--chroot` bug CVE-2025-32463 is).
|
|
|
|
## Research credit
|
|
|
|
Discovered and disclosed by **Rich Mirch — Stratascale Cyber Research
|
|
Unit (CRU)**, published 2025-06-30 alongside CVE-2025-32463.
|
|
|
|
- sudo.ws advisory: <https://www.sudo.ws/security/advisories/host_any/>
|
|
- Stratascale writeup:
|
|
<https://www.stratascale.com/resource/cve-2025-32462-sudo-host-option-vulnerability/>
|
|
- Fixed in sudo 1.9.17p1 (Todd C. Miller, upstream maintainer).
|
|
|
|
All research credit belongs to Rich Mirch / Stratascale and the sudo
|
|
maintainers. SKELETONKEY is the bundling and bookkeeping layer only.
|
|
|
|
## SKELETONKEY role
|
|
|
|
🟢 **Structural escape (config-gated).** No offsets, no leak, no race.
|
|
`detect()` gates on the sudo version (the host-restricted rule lives in a
|
|
sudoers source the user usually cannot read — that opacity is the bug),
|
|
so a VULNERABLE verdict means "vulnerable sudo present; an abusable rule
|
|
may exist". `exploit()` best-effort reads `/etc/sudoers` +
|
|
`/etc/sudoers.d/*` for a user-spec whose host field is neither the
|
|
current hostname nor `ALL` (or takes the host from
|
|
`SKELETONKEY_SUDO_HOST`), witnesses with `sudo -n -h <host> id -u`, and
|
|
pops `sudo -h <host> /bin/bash` (override via `SKELETONKEY_SUDO_CMD`)
|
|
only on a confirmed uid-0 witness — never claims root it did not get.
|
|
|
|
Mitigation: upgrade sudo to 1.9.17p1+. Architecture-agnostic
|
|
(pure userspace). Joins the shared `sudo` family alongside
|
|
`sudo_chwoot`, `sudo_samedit`, `sudo_runas_neg1`, and `sudoedit_editor`.
|