Privilege Escalation via Misconfigured sudo Rule

A commonly applied sudo configuration pattern allows local users to escalate to root on Linux systems through a wildcard expansion flaw in sudoedit.

The sudoedit command, when configured with wildcard rules, is vulnerable to a directory traversal that allows users to edit files outside the permitted paths. By crafting a path that includes directory traversal sequences combined with a wildcard match, a local user can escalate to edit sensitive system files and gain root access.

Systems are affected when the sudoers file contains rules of the form:

1user ALL=(root) NOPASSWD: sudoedit /path/to/dir/*

Upgrade sudo to version 1.9.12p2 or later. As a workaround, avoid wildcard patterns in sudoedit rules.