CVE-2021-23240

selinux_edit_copy_tfiles in sudoedit in Sudo before 1.9.5 allows a local unprivileged user to gain file ownership and escalate privileges by replacing a temporary file with a symlink to an arbitrary file target. This affects SELinux RBAC support in permissive mode. Machines without SELinux are not vulnerable.

Affected products

Alt Linux, Centos, Red Hat, Rocky Linux, Sudo, Suse

Sudo Project Sudo

< 1.8.32, 1.9.5

Fix

Available

CVSS 3.1

7.8 HIGH

EPSS

1.1% (61th percentile)

Weakness

CWE-59

NVD status

Modified

Published

2021-01-12

No exploit for CVE-2021-23240 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.