Local Privilege Escalation Vulnerability in Sudo Product by Sudo

CVE-2021-23239

Summary

The sudoedit feature in Sudo versions before 1.9.5 contains a vulnerability that may allow unprivileged users to conduct arbitrary directory-existence checks. This can be exploited through a race condition in the sudo_edit.c file, where an attacker can replace a user-controlled directory with a symlink targeting an arbitrary location, potentially leading to unauthorized file access and privilege escalation.

References