SVG:Advisory-SVG-CVE-2021-3156

Main page

Software Security Checklist

Issue Handling

Advisories

Notes On Risk

Advisory Template

More

---

Advisory-SVG-CVE-2021-3156

Title:       EGI SVG 'ADVISORY' [TLP:WHITE] CRITICAL risk - sudo privilege escalation vulnerability CVE-2021-3156. [EGI-SVG-CVE-2021-3156]

Date:        2021-01-27
Updated: 

Affected software and risk
==========================

CRITICAL risk vulnerability concerning sudo

Package : sudo
CVE ID  : CVE-2021-3156

A local privilege escalation vulnerability has been disclosed [R 1][R 2] in the sudo package in versions prior to the patched versions referenced below.

Actions required
================

Sites are required immediately to update the packages or apply the mitigation described below to all user-accessible systems; these include in particular WNs and UIs.

All running resources MUST be either patched or have mitigation in place or software removed by 2021-02-04T00:00+00

Sites failing to act and/or failing to respond to requests from the EGI CSIRT team risk site suspension.

Component installation information
==================================

Patches are available directly from vendor repos; see [R 3-7]

Details of patched versions for RedHat distributions are:

RHEL/CentOS7: sudo-1.8.23-10.el7_9.1
RHEL/CentOS8: sudo-1.8.29-6.el8_3.1

For other distributions see the links referenced below.
 
Mitigation
==========

If an update is not possible, for example for unsupported operating systems pending migration, sites are required to implement one of the following mitigations (in order of preference):

*If sudo is not actively used:*
* Remove it from their systems (yum remove sudo)
* Remove the SUID bit on the binary (chmod u-s /usr/bin/sudo) or 
* Remove the execution bit on the binary (chmod go-x /usr/bin/sudo).

*If sudo is actively used:*
* Apply the systemtap script mentioned in [R 2], after every boot of the system.
* Change the access (access bits & acls) on /usr/bin/sudo to restrict it to a smaller set of users/group.

Please note that these last two mitigations *will not be accepted* as a long term solution for this vulnerability, i.e. updates are required.

Affected software details
=========================

All versions of sudo prior to the patched versions are understood to be vulnerable.


More information
================

A heap-based buffer overflow was found in the way sudo parses command line arguments. This flaw is exploitable by any local user (normal users and system users, sudoers and non-sudoers), without authentication (i.e., the attacker does not need to know the user's password). Successful exploitation of this flaw could lead to privilege escalation. [R 2]

TLP and URL
===========

** WHITE information - Unlimited distribution - see https://wiki.egi.eu/wiki/EGI_CSIRT:TLP for distribution restrictions ** 

URL:   https://wiki.egi.eu/wiki/SVG:Advisory-SVG-CVE-2021-3156

Minor updates may be made without re-distribution to the sites

Comments
========

Comments or questions should be sent to svg-rat  at  mailman.egi.eu

If you find or become aware of another vulnerability which is relevant to EGI you may report it by e-mail to

report-vulnerability at egi.eu
 
the EGI Software Vulnerability Group will take a look according to the procedure defined in [R 8]

Note that this is undergoing revision to fully handle vulnerabilities in the EOSC-hub era. 


References
==========

[R 1] https://seclists.org/oss-sec/2021/q1/71
[R 2] https://access.redhat.com/security/cve/CVE-2021-3156
[R 3] https://access.redhat.com/errata/RHSA-2021:0221 (RHEL7)
[R 4] https://access.redhat.com/errata/RHSA-2021:0218 (RHEL8)
[R 5] https://lists.centos.org/pipermail/centos-announce/2021-January/048252.html (CentOS 7)
[R 6] https://ubuntu.com/security/CVE-2021-3156 (Ubuntu)
[R 7] https://security-tracker.debian.org/tracker/CVE-2021-3156 (Debian)
[R 8] https://documents.egi.eu/public/ShowDocument?docid=3145

Credit
======

SVG was alerted to this vulnerability by Tobias Dussa.

Timeline
========

Yyyy-mm-dd  [EGI-SVG-CVE-2021-3156] 

2021-01-26 Vulnerability reported by Tobias Dussa
2021-01-26 Acknowledgement from the EGI SVG to the reporter
2021-01-27 EGI SVG Risk Assessment completed
2021-01-27 Updated packages available
2021-01-27 Advisory/Alert sent to sites

Context
=======

This advisory has been prepared as part of the effort to fulfil EGI SVG's purpose 
"To minimize the risk to the EGI infrastructure arising from software vulnerabilities"

The risk is that assessed by the group, according to the EGI SVG issue handling procedure [R 8]  in the context of how the software is used in the EGI infrastructure. It is the opinion of the group, we do not guarantee it to be correct. The risk may also be higher or lower in other deployments depending on how the software is used.   

Others may re-use this information provided they:-

1) Respect the provided TLP classification

2) Credit the EGI https://www.egi.eu/ Software Vulnerability Group


Note that the SVG issue handling procedure is currently under review, to take account of the increasing inhomogeneity of the EGI infrastructure and the services in the EOSC-hub catalogue.

On behalf of the EGI SVG,

David Crooks
EGI CSIRT Security Officer On Duty