CVE-2023-22809 Privilege escalation in n/a
A local attacker can escalate privileges by manipulating editor environment variables in sudoedit to append arbitrary files to the processing list.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-22809?
CVE-2023-22809 is a high-severity vulnerability in Apple Macos, published on 18 Jan 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environment variables (SUDO_EDITOR, VISUAL, and EDITOR), allowing a local attacker to append arbitrary entries to the list of files to process. This can lead to privilege escalation. Affected versions are 1.8.0 through 1.9.12.p1. The problem exists because a user-specified editor may contain a "--" argument that defeats a protection mechanism, e.g., an EDITOR='vim -- /path/to/extra/file' value.
Weakness: CWE-269
Which versions are affected by CVE-2023-22809?
It affects 4 products.
Linux distribution packages (40)
sudo AlmaLinux:8 | All versions | 1.8.29-8.el8_7.1 |
sudo AlmaLinux:9 | All versions | 1.9.5p2-7.el9_1.1 |
sudo-python-plugin AlmaLinux:9 | All versions | 1.9.5p2-7.el9_1.1 |
sudo Red Hat:enterprise_linux:7::client | All versions | 0:1.8.23-10.el7_9.3 |
sudo-debuginfo Red Hat:enterprise_linux:7::client | All versions | 0:1.8.23-10.el7_9.3 |
sudo-devel Red Hat:enterprise_linux:7::client | All versions | 0:1.8.23-10.el7_9.3 |
sudo-debuginfo Red Hat:enterprise_linux:7::computenode | All versions | 0:1.8.23-10.el7_9.3 |
sudo-devel Red Hat:enterprise_linux:7::computenode | All versions | 0:1.8.23-10.el7_9.3 |
sudo Red Hat:enterprise_linux:7::server | All versions | 0:1.8.23-10.el7_9.3 |
sudo-debuginfo Red Hat:enterprise_linux:7::server | All versions | 0:1.8.23-10.el7_9.3 |
sudo-devel Red Hat:enterprise_linux:7::server | All versions | 0:1.8.23-10.el7_9.3 |
sudo Red Hat:enterprise_linux:7::workstation | All versions | 0:1.8.23-10.el7_9.3 |
sudo-debuginfo Red Hat:enterprise_linux:7::workstation | All versions | 0:1.8.23-10.el7_9.3 |
sudo-devel Red Hat:enterprise_linux:7::workstation | All versions | 0:1.8.23-10.el7_9.3 |
sudo Red Hat:enterprise_linux:8::baseos | All versions | 0:1.8.29-8.el8_7.1 |
sudo-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 0:1.8.29-8.el8_7.1 |
sudo-debugsource Red Hat:enterprise_linux:8::baseos | All versions | 0:1.8.29-8.el8_7.1 |
sudo-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:1.9.5p2-7.el9_1.1 |
sudo-debugsource Red Hat:enterprise_linux:9::appstream | All versions | 0:1.9.5p2-7.el9_1.1 |
sudo-python-plugin Red Hat:enterprise_linux:9::appstream | All versions | 0:1.9.5p2-7.el9_1.1 |
sudo-python-plugin-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:1.9.5p2-7.el9_1.1 |
sudo Red Hat:enterprise_linux:9::baseos | All versions | 0:1.9.5p2-7.el9_1.1 |
sudo-debuginfo Red Hat:enterprise_linux:9::baseos | All versions | 0:1.9.5p2-7.el9_1.1 |
sudo-debugsource Red Hat:enterprise_linux:9::baseos | All versions | 0:1.9.5p2-7.el9_1.1 |
sudo-python-plugin-debuginfo Red Hat:enterprise_linux:9::baseos | All versions | 0:1.9.5p2-7.el9_1.1 |
sudo Red Hat:rhel_aus:7.4::server | All versions | 0:1.8.19p2-12.el7_4.3 |
sudo-debuginfo Red Hat:rhel_aus:7.4::server | All versions | 0:1.8.19p2-12.el7_4.3 |
sudo-devel Red Hat:rhel_aus:7.4::server | All versions | 0:1.8.19p2-12.el7_4.3 |
sudo Red Hat:rhel_aus:7.6::server | All versions | 0:1.8.23-3.el7_6.3 |
sudo-debuginfo Red Hat:rhel_aus:7.6::server | All versions | 0:1.8.23-3.el7_6.3 |
sudo-devel Red Hat:rhel_aus:7.6::server | All versions | 0:1.8.23-3.el7_6.3 |
sudo Red Hat:rhel_aus:7.7::server | All versions | 0:1.8.23-4.el7_7.4 |
sudo-debuginfo Red Hat:rhel_aus:7.7::server | All versions | 0:1.8.23-4.el7_7.4 |
sudo-devel Red Hat:rhel_aus:7.7::server | All versions | 0:1.8.23-4.el7_7.4 |
sudo Red Hat:rhel_aus:8.2::baseos | All versions | 0:1.8.29-5.el8_2.2 |
sudo-debuginfo Red Hat:rhel_aus:8.2::baseos | All versions | 0:1.8.29-5.el8_2.2 |
sudo-debugsource Red Hat:rhel_aus:8.2::baseos | All versions | 0:1.8.29-5.el8_2.2 |
sudo Red Hat:rhel_e4s:7.7::server | All versions | 0:1.8.23-4.el7_7.4 |
sudo-debuginfo Red Hat:rhel_e4s:7.7::server | All versions | 0:1.8.23-4.el7_7.4 |
sudo-devel Red Hat:rhel_e4s:7.7::server | All versions | 0:1.8.23-4.el7_7.4 |
Products include Apple Macos, Debian Debian Linux, Fedoraproject Fedora, Sudo Project Sudo.
How do I fix CVE-2023-22809?
Upgrade to a fixed version.
Is CVE-2023-22809 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-22809 exists.
Public exploit code: 1 Metasploit module, 1 Exploit-DB entry and 12 proofs of concept on GitHub.
Other vulnerabilities in Apple Macos
Sources
Also known as ALPINE-CVE-2023-22809, ALSA-2023:0282, ALSA-2023:0284, AZL-13030, CLSA-2023-1675984342, CLSA-2023-1675984682 and 33 more.