-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability allowed users with limited sudo privileges to list the sudo privileges of other users using the -U flag. This was due to insufficient permission checks in the sudo_rs::sudoers::Sudoers::check_list_permission function. Specifically, when -U <other_user> was used, the function did not verify if the invoking user had the explicit right (the 'list' pseudo-command) to inspect the other user's privileges. The patches address this by:
63fa222...) so administrators can define this permission.ListRequest to explicitly include the inspected_user (commit 598cacd...).Sudoers::check_list_permission (commit bd780dc...) to perform a specific check using self.check(...) with command: Path::new(\"list\") when the inspected_user is different from the invoking_user.
The functions auth_invoking_user and check_other_users_list_perms in src/sudo/pipeline/list.rs are part of the call chain that leads to the vulnerable check_list_permission function.| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| sudo-rs | rust | < 0.2.6 | 0.2.6 |