3 ms·

Security issues discovered in sudo-rs

24 points by kahlonel 1y ago

portmanteaufu 1y ago
To save everyone a click, the text is: """ Two security issues were discovered in sudo-rs, a Rust-based implemention of sudo (and su), which could result in the local disclosure of partially typed passwords or an authentication bypass in some targetpw/rootpw configurations. For the stable distribution (trixie), this problem has been fixed in version 0.2.5-5+deb13u1. We recommend that you upgrade your rust-sudo-rs packages. """
wiz21c 1y ago
as far as i can see, it's just programming errors, nothing to do with rust.
- _flux 1y ago
  Everything to do with reimplementing sudo, though. But sudo has its share of CVEs as well (latest CVE-2025-32463), so perhaps a fresh look on the tool is warranted; perhaps some learnings have been taken from it.
  - noobermin 1y ago
    I think if rust was used to replace other bits (say things like utilities like grep or whatever) instead of security vital things like sudo, there would be less complaints.
    - _flux 1y ago
      Do you mean like uutils/coreutils.. Which certainly collects complaints :).
      - noobermin 1y ago
        No doubt. I'm just guessing people would grumble less.
  - ciupicri 1y ago
    A fresh look would be perhaps doas [1] from the OpenBSD project. [1]: https://man.openbsd.org/doas.1 https://man.openbsd.org/doas.1
    - _flux 1y ago
      sudo-rs tries to be more or less a drop-in replacement for the original one, though, meaning minimal reconfiguration should be required for it.
- never_inline 1y ago
  Do they have test suite comparable to that of original sudo, or can they reuse the test suite of original sudo?
- egorfine 1y ago
  Same could be said about many of the real sudo bugs, but that argument doesn't stick with rust fanboys. (Obligatory disclaimer: I love rust, I hate fanboys and rewrites)
_flux 1y ago
What were the actual fixes like?
- thw_9a83c 1y ago
  There is a link to github commit in the "Notes" section for each CVE [1]. [1]: https://security-tracker.debian.org/tracker/source-package/rust-sudo-rs https://security-tracker.debian.org/tracker/source-package/r...
  - _flux 1y ago
    Well, doesn't seem the issue would have been avoidable other than with "harder thinking" or better testing or something like that. Maybe model checkers could be used, but perhaps the search space is too large for all the featuers, and keeping the source in sync with the model could be quite fragile. And who knows, maybe the model would have the same issue.
    - whatevaa 1y ago
      Sudo is overcomplicated and since this is a drop-in replacement, it inherits all the complexities.
deleted 1y ago
[deleted]
deleted 1y ago
[deleted]
m4rtink 1y ago
But memory safety!

24 points by kahlonel 1y ago

To save everyone a click, the text is: """ Two security issues were discovered in sudo-rs, a Rust-based implemention of sudo (and su), which could result in the local disclosure of partially typed passwords or an authentication bypass in some targetpw/rootpw configurations. For the stable distribution (trixie), this problem has been fixed in version 0.2.5-5+deb13u1. We recommend that you upgrade your rust-sudo-rs packages. """

wiz21c 1y ago

as far as i can see, it's just programming errors, nothing to do with rust.

_flux 1y ago
Everything to do with reimplementing sudo, though. But sudo has its share of CVEs as well (latest CVE-2025-32463), so perhaps a fresh look on the tool is warranted; perhaps some learnings have been taken from it.
- noobermin 1y ago
  I think if rust was used to replace other bits (say things like utilities like grep or whatever) instead of security vital things like sudo, there would be less complaints.
  - _flux 1y ago
    Do you mean like uutils/coreutils.. Which certainly collects complaints :).
    - noobermin 1y ago
      No doubt. I'm just guessing people would grumble less.
- ciupicri 1y ago
  A fresh look would be perhaps doas [1] from the OpenBSD project. [1]: https://man.openbsd.org/doas.1 https://man.openbsd.org/doas.1
  - _flux 1y ago
    sudo-rs tries to be more or less a drop-in replacement for the original one, though, meaning minimal reconfiguration should be required for it.
never_inline 1y ago
Do they have test suite comparable to that of original sudo, or can they reuse the test suite of original sudo?
egorfine 1y ago
Same could be said about many of the real sudo bugs, but that argument doesn't stick with rust fanboys. (Obligatory disclaimer: I love rust, I hate fanboys and rewrites)

_flux 1y ago

What were the actual fixes like?

thw_9a83c 1y ago
There is a link to github commit in the "Notes" section for each CVE [1]. [1]: https://security-tracker.debian.org/tracker/source-package/rust-sudo-rs https://security-tracker.debian.org/tracker/source-package/r...
- _flux 1y ago
  Well, doesn't seem the issue would have been avoidable other than with "harder thinking" or better testing or something like that. Maybe model checkers could be used, but perhaps the search space is too large for all the featuers, and keeping the source in sync with the model could be quite fragile. And who knows, maybe the model would have the same issue.
  - whatevaa 1y ago
    Sudo is overcomplicated and since this is a drop-in replacement, it inherits all the complexities.

deleted 1y ago

[deleted]

deleted 1y ago

[deleted]

m4rtink 1y ago

But memory safety!