1 files changed, 113 insertions, 0 deletions

diff --git a/meta/recipes-extended/sudo/files/CVE-2023-22809.patch b/meta/recipes-extended/sudo/files/CVE-2023-22809.patch
new file mode 100644
index 0000000000..6c47eb3e44
--- /dev/null
+++ b/meta/recipes-extended/sudo/files/CVE-2023-22809.patch
@@ -0,0 +1,113 @@
+Backport of:
+
+# HG changeset patch
+# Parent  7275148cad1f8cd3c350026460acc4d6ad349c3a
+sudoedit: do not permit editor arguments to include "--"
+We use "--" to separate the editor and arguments from the files to edit.
+If the editor arguments include "--", sudo can be tricked into allowing
+the user to edit a file not permitted by the security policy.
+Thanks to Matthieu Barjole and Victor Cutillas of Synacktiv
+(https://synacktiv.com) for finding this bug.
+
+CVE: CVE-2023-22809
+Upstream-Staus: Backport [http://archive.ubuntu.com/ubuntu/pool/main/s/sudo/sudo_1.8.31-1ubuntu1.4.debian.tar.xz]
+Signed-off-by: Omkar Patil <omkar.patil@kpit.com>
+
+--- a/plugins/sudoers/editor.c
++++ b/plugins/sudoers/editor.c
+@@ -56,7 +56,7 @@ resolve_editor(const char *ed, size_t ed
+     const char *cp, *ep, *tmp;
+     const char *edend = ed + edlen;
+     struct stat user_editor_sb;
+-    int nargc;
++    int nargc = 0;
+     debug_decl(resolve_editor, SUDOERS_DEBUG_UTIL)
+ 
+     /*
+@@ -102,6 +102,21 @@ resolve_editor(const char *ed, size_t ed
+            free(editor_path);
+            while (nargc--)
+                free(nargv[nargc]);
++           free(nargv);
++           debug_return_str(NULL);
++       }
++
++       /*
++        * We use "--" to separate the editor and arguments from the files
++        * to edit.  The editor arguments themselves may not contain "--".
++        */
++       if (strcmp(nargv[nargc], "--") == 0) {
++           sudo_warnx(U_("ignoring editor: %.*s"), (int)edlen, ed);
++           sudo_warnx("%s", U_("editor arguments may not contain \"--\""));
++           errno = EINVAL;
++           free(editor_path);
++           while (nargc--)
++               free(nargv[nargc]);
+            free(nargv);
+            debug_return_str(NULL);
+        }
+--- a/plugins/sudoers/sudoers.c
++++ b/plugins/sudoers/sudoers.c
+@@ -616,20 +616,31 @@ sudoers_policy_main(int argc, char * con
+ 
+     /* Note: must call audit before uid change. */
+     if (ISSET(sudo_mode, MODE_EDIT)) {
++       const char *env_editor = NULL;
+        int edit_argc;
+-       const char *env_editor;
+ 
+        free(safe_cmnd);
+        safe_cmnd = find_editor(NewArgc - 1, NewArgv + 1, &edit_argc,
+            &edit_argv, NULL, &env_editor, false);
+        if (safe_cmnd == NULL) {
+-           if (errno != ENOENT)
++           switch (errno) {
++           case ENOENT:
++               audit_failure(NewArgc, NewArgv, N_("%s: command not found"),
++                   env_editor ? env_editor : def_editor);
++               sudo_warnx(U_("%s: command not found"),
++                   env_editor ? env_editor : def_editor);
++               goto bad;
++           case EINVAL:
++               if (def_env_editor && env_editor != NULL) {
++                   /* User tried to do something funny with the editor. */
++                   log_warningx(SLOG_NO_STDERR|SLOG_SEND_MAIL,
++                       "invalid user-specified editor: %s", env_editor);
++                   goto bad;
++               }
++               /* FALLTHROUGH */
++           default:
+                goto done;
+-           audit_failure(NewArgc, NewArgv, N_("%s: command not found"),
+-               env_editor ? env_editor : def_editor);
+-           sudo_warnx(U_("%s: command not found"),
+-               env_editor ? env_editor : def_editor);
+-           goto bad;
++           }
+        }
+        if (audit_success(edit_argc, edit_argv) != 0 && !def_ignore_audit_errors)
+            goto done;
+--- a/plugins/sudoers/visudo.c
++++ b/plugins/sudoers/visudo.c
+@@ -308,7 +308,7 @@ static char *
+ get_editor(int *editor_argc, char ***editor_argv)
+ {
+     char *editor_path = NULL, **whitelist = NULL;
+-    const char *env_editor;
++    const char *env_editor = NULL;
+     static char *files[] = { "+1", "sudoers" };
+     unsigned int whitelist_len = 0;
+     debug_decl(get_editor, SUDOERS_DEBUG_UTIL)
+@@ -342,7 +342,11 @@ get_editor(int *editor_argc, char ***edi
+     if (editor_path == NULL) {
+        if (def_env_editor && env_editor != NULL) {
+            /* We are honoring $EDITOR so this is a fatal error. */
+-           sudo_fatalx(U_("specified editor (%s) doesn't exist"), env_editor);
++           if (errno == ENOENT) {
++               sudo_warnx(U_("specified editor (%s) doesn't exist"),
++                   env_editor);
++           }
++           exit(EXIT_FAILURE);
+        }
+        sudo_fatalx(U_("no editor found (editor path = %s)"), def_editor);
+     }