Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2023-42465

Sudo before 1.9.15 might allow row hammer attacks (for authentication bypass or privilege escalation) because application logic sometimes is based on not equaling an error value (instead of equaling a success value), and because the values do not resist flips of a single bit.

Published

2023-12-22T16:15:08.057

Last Modified

2024-11-21T08:22:36.407

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 7.0 (HIGH)

Weaknesses

Type: Primary
NVD-CWE-noinfo

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	sudo_project	sudo	< 1.9.15	Yes

References

https://arxiv.org/abs/2309.02545 Technical Description, Third Party Advisory ([email protected])
https://github.com/sudo-project/sudo/commit/7873f8334c8d31031f8cfa83bd97ac6029309e4f Patch ([email protected])
https://github.com/sudo-project/sudo/releases/tag/SUDO_1_9_15 Release Notes ([email protected])
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R4Q23NHCKCLFIHSNY6KJ27GM7FSCEVXM/ ([email protected])
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U6XMRUJCPII4MPWG43HTYR76DGLEYEFZ/ ([email protected])
https://security.gentoo.org/glsa/202401-29 ([email protected])
https://security.netapp.com/advisory/ntap-20240208-0002/ ([email protected])
https://www.openwall.com/lists/oss-security/2023/12/21/9 Exploit, Mailing List ([email protected])
https://www.sudo.ws/releases/changelog/ Release Notes ([email protected])
https://arxiv.org/abs/2309.02545 Technical Description, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/sudo-project/sudo/commit/7873f8334c8d31031f8cfa83bd97ac6029309e4f Patch (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/sudo-project/sudo/releases/tag/SUDO_1_9_15 Release Notes (af854a3a-2127-422b-91ae-364da2661108)
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R4Q23NHCKCLFIHSNY6KJ27GM7FSCEVXM/ (af854a3a-2127-422b-91ae-364da2661108)
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U6XMRUJCPII4MPWG43HTYR76DGLEYEFZ/ (af854a3a-2127-422b-91ae-364da2661108)
https://security.gentoo.org/glsa/202401-29 (af854a3a-2127-422b-91ae-364da2661108)
https://security.netapp.com/advisory/ntap-20240208-0002/ (af854a3a-2127-422b-91ae-364da2661108)
https://www.openwall.com/lists/oss-security/2023/12/21/9 Exploit, Mailing List (af854a3a-2127-422b-91ae-364da2661108)
https://www.sudo.ws/releases/changelog/ Release Notes (af854a3a-2127-422b-91ae-364da2661108)