Vulnerability Intelligence Report
CVE-2021-23240
selinux_edit_copy_tfiles in sudoedit in Sudo before 1.9.5 allows a local unprivileged user to gain file ownership and escalate privileges by replacing a temporary file with a symlink to an arbitrary file target. This affects SELinux RBAC support in permissive mode. Machines without SELinux are not vulnerable.
No Active Exploit Signals
CVSS Base Score
7.8
HIGH
EPSS Probability:1.07%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| sudo_project | sudo | all |
| netapp | hci_management_node | all |
| netapp | solidfire | all |
| fedoraproject | fedora | 32, 33 |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
1.066%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | MITRE Corporation · N/A · USA |
| Reserved | 2021-01-07T00:00:00 |
| Published | 2021-01-12T08:17:44 |
| Last Updated | 2024-08-03T19:05:54 |
Community Chatter & Buzz