3 ms·
Would it be possible to mitigate this by setting the immutable flag on /etc/sudoers: chflags uchg /etc/sudoers
by athenot 11y ago
Would it be possible to mitigate this by setting the immutable flag on /etc/sudoers:
chflags uchg /etc/sudoers
- odonnellryan 11y agoThere's a patch here: https://github.com/sektioneins/SUIDGuard https://github.com/sektioneins/SUIDGuard
- geofft 11y agoNo, because the vulnerability is that you can write to arbitrary files with root privileges. It turns out that sudoers is the easiest file to write to to gain persistent root, but there are millions of other things: /etc/passwd, /etc/cron.d, /root/.ssh/authorized_keys, any binary that's run by root, etc.
- chjj 11y ago/etc/sudoers is not the only potential target here. Even if that did work, this vulnerability could still brick your entire OS. They could overwrite any file they wanted to.