CVE-2021-23239

The sudoedit personality of Sudo before 1.9.5 may allow a local unprivileged user to perform arbitrary directory-existence tests by winning a sudo_edit.c race condition in replacing a user-controlled directory by a symlink to an arbitrary path.

The sudoedit personality of Sudo before 1.9.5 may allow a local unprivileged user to perform arbitrary directory-existence tests by winning a sudo_edit.c race condition in replacing a user-controlled directory by a symlink to an arbitrary path.

A flaw was found in sudo. A heap-based buffer overflow was found in the way sudo parses command line arguments. This flaw is exploitable by any local user (normal users and system users, sudoers and non-sudoers), without authentication (i.e., the attacker does not need to know the user's password). Successful exploitation of this flaw could lead to privilege escalation. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.(CVE-2021-3156)\r\n\r\n The sudoedit personality of Sudo before 1.9.5 may allow a local unprivileged user to perform arbitrary directory-existence tests by winning a sudo_edit.c race condition in replacing a user-controlled directory by a symlink to an arbitrary path.(CVE-2021-23239)\r\n\r\n selinux_edit_copy_tfiles in sudoedit in Sudo before 1.9.5 allows a local unprivileged user to gain file ownership and escalate privileges by replacing a temporary file with a symlink to an arbitrary file target. This affects SELinux RBAC support in permissive mode. Machines without SELinux are not vulnerable.(CVE-2021-23240)\r\n\r\n

The sudo packages contain the sudo utility which allows system administrators to provide certain users with the permission to execute privileged commands, which are used for system management purposes, without having to log in as root.

Security Fix(es):

• sudo: symbolic link attack in SELinux-enabled sudoedit (CVE-2021-23240)

• sudo: possible directory existence test due to race condition in sudoedit (CVE-2021-23239)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.4 Release Notes linked from the References section.

The sudoedit personality of Sudo before 1.9.5 may allow a local unprivileged user to perform arbitrary directory-existence tests by winning a sudo_edit.c race condition in replacing a user-controlled directory by a symlink to an arbitrary path.

• CVE-2021-23239: fix potential directory existence info leak in sudoedit
• CVE-2023-28486: escape control characters in log messages
• CVE-2023-28487: escape control characters in sudoreplay output

• CVE-2021-23239: fix potential directory existence info leak in sudoedit
• CVE-2023-28486: escape control characters in log messages
• CVE-2023-28487: escape control characters in sudoreplay output

• Rebase onto the vendor's sudo-1.8.23-10.0.3.el7_9.3 sources
• CVE-2025-32462: take the vendor's fix, keep our audit record of the rejected remote host
• CVE-2026-35535 is now fixed by the vendor (sudo-1.8.23-CVE-2026-35535.patch); the TuxCare duplicate is dropped
• Retained TuxCare fixes: CVE-2021-23239, CVE-2021-23240, CVE-2023-28486, CVE-2023-28487, CVE-2023-42465

• Rebase onto the vendor's sudo-1.8.23-10.0.3.el7_9.3 sources
• CVE-2025-32462: take the vendor's fix, keep our audit record of the rejected remote host
• CVE-2026-35535 is now fixed by the vendor (sudo-1.8.23-CVE-2026-35535.patch); the TuxCare duplicate is dropped
• Retained TuxCare fixes: CVE-2021-23239, CVE-2021-23240, CVE-2023-28486, CVE-2023-28487, CVE-2023-42465

• Rebase onto the vendor's sudo-1.8.23-10.0.3.el7_9.3 sources
• CVE-2025-32462: take the vendor's fix, keep our audit record of the rejected remote host
• CVE-2026-35535 is now fixed by the vendor (sudo-1.8.23-CVE-2026-35535.patch); the TuxCare duplicate is dropped
• Retained TuxCare fixes: CVE-2021-23239, CVE-2021-23240, CVE-2023-28486, CVE-2023-28487, CVE-2023-42465

The sudoedit personality of Sudo before 1.9.5 may allow a local unprivileged user to perform arbitrary directory-existence tests by winning a sudo_edit.c race condition in replacing a user-controlled directory by a symlink to an arbitrary path. (CVE-2021-23239).

selinux_edit_copy_tfiles in sudoedit in Sudo before 1.9.5 allows a local unprivileged user to gain file ownership and escalate privileges by replacing a temporary file with a symlink to an arbitrary file target. This affects SELinux RBAC support in permissive mode. Machines without SELinux are not vulnerable. (CVE-2021-23240).

This update for sudo fixes the following issues:

• A Heap-based buffer overflow in sudo could be exploited to allow a user to gain root privileges [bsc#1181090,CVE-2021-3156]
• It was possible for a user to test for the existence of a directory due to a Race Condition in sudoedit [bsc#1180684,CVE-2021-23239]
• A Possible Symlink Attack vector existed in sudoedit if SELinux was running in permissive mode [bsc#1180685, CVE-2021-23240]
• It was possible for a User to enable Debug Settings not Intended for them [bsc#1180687]

This update was imported from the SUSE:SLE-15:Update update project.

This update for sudo fixes the following issues:

• A Heap-based buffer overflow in sudo could be exploited to allow a user to gain root privileges [bsc#1181090,CVE-2021-3156]
• It was possible for a user to test for the existence of a directory due to a Race Condition in sudoedit [bsc#1180684,CVE-2021-23239]
• A Possible Symlink Attack vector existed in sudoedit if SELinux was running in permissive mode [bsc#1180685, CVE-2021-23240]
• It was possible for a User to enable Debug Settings not Intended for them [bsc#1180687]

This update was imported from the SUSE:SLE-15:Update update project.

These are all security issues fixed in the sudo-1.9.7p2-1.4 package on the GA media of openSUSE Tumbleweed.

This update for sudo fixes the following issues:

• A Heap-based buffer overflow in sudo could be exploited to allow a user to gain root privileges [bsc#1181090,CVE-2021-3156]
• It was possible for a user to test for the existence of a directory due to a Race Condition in sudoedit [bsc#1180684,CVE-2021-23239]
• A Possible Symlink Attack vector existed in sudoedit if SELinux was running in permissive mode [bsc#1180685, CVE-2021-23240]
• It was possible for a User to enable Debug Settings not Intended for them [bsc#1180687]

This update for sudo fixes the following issues:

• A Heap-based buffer overflow in sudo could be exploited to allow a user to gain root privileges [bsc#1181090,CVE-2021-3156]
• It was possible for a user to test for the existence of a directory due to a Race Condition in sudoedit [bsc#1180684,CVE-2021-23239]
• A Possible Symlink Attack vector existed in sudoedit if SELinux was running in permissive mode [bsc#1180685, CVE-2021-23240]
• It was possible for a User to enable Debug Settings not Intended for them [bsc#1180687]

This update for sudo fixes the following issues:

• A Heap-based buffer overflow in sudo could be exploited to allow a user to gain root privileges [bsc#1181090,CVE-2021-3156]
• It was possible for a user to test for the existence of a directory due to a Race Condition in sudoedit [bsc#1180684,CVE-2021-23239]
• A Possible Symlink Attack vector existed in sudoedit if SELinux was running in permissive mode [bsc#1180685, CVE-2021-23240]
• It was possible for a User to enable Debug Settings not Intended for them [bsc#1180687]

This update for sudo fixes the following issues:

• A Heap-based buffer overflow in sudo could be exploited to allow a user to gain root privileges [bsc#1181090,CVE-2021-3156]
• It was possible for a user to test for the existence of a directory due to a Race Condition in sudoedit [bsc#1180684,CVE-2021-23239]

It was discovered that Sudo incorrectly handled memory when parsing command lines. A local attacker could possibly use this issue to obtain unintended access to the administrator account. (CVE-2021-3156)

It was discovered that the Sudo sudoedit utility incorrectly handled checking directory permissions. A local attacker could possibly use this issue to bypass file permissions and determine if a directory exists or not. (CVE-2021-23239)