CVE-2015-8239: sudo_project sudo Race Condition

Vulnerability summary

CVE-2015-8239 is a high (CVSS 7.0) Race Condition vulnerability in sudo_project sudo. EPSS estimates a 0.54% chance of exploitation in the next 30 days, higher than 44.3% of scored vulnerabilities.

Timeline

1. 10-10-2017
   PublishedVulnerability first disclosed.
2. 06-08-2024
   Last modifiedVulnerability information updated.

Description

The SHA-2 digest support in the sudoers plugin in sudo after 1.8.7 allows local users with write permissions to parts of the called command to replace them before it is executed.

• CWE-362Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.