CVE-2011-0010
published 2011-01-18CVE-2011-0010: check.c in sudo 1.7.x before 1.7.4p5, when a Runas group is configured, does not require a password for command execution that involves a gid change but no uid…
PriorityP417medium4.4CVSS 2.0
AVLACMAuNCPIPAP
EPSS
0.50%
39.3th percentile
check.c in sudo 1.7.x before 1.7.4p5, when a Runas group is configured, does not require a password for command execution that involves a gid change but no uid change, which allows local users to bypass an intended authentication requirement via the -g option to a sudo command.
Affected
21 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | sudo | < sudo 1.7.4p4-6 (bookworm) | sudo 1.7.4p4-6 (bookworm) |
| sudo_project | sudo | >= 0 < 1.7.4p4-6 | 1.7.4p4-6 |
| sudo_project | sudo | >= 0 < 1.7.4p4-6 | 1.7.4p4-6 |
| sudo_project | sudo | >= 0 < 1.7.4p4-6 | 1.7.4p4-6 |
| sudo_project | sudo | >= 0 < 1.7.4p4-6 | 1.7.4p4-6 |
| todd_miller | sudo | — | — |
| todd_miller | sudo | — | — |
| todd_miller | sudo | — | — |
| todd_miller | sudo | — | — |
| todd_miller | sudo | — | — |
| todd_miller | sudo | — | — |
| todd_miller | sudo | — | — |
| todd_miller | sudo | — | — |
| todd_miller | sudo | — | — |
| todd_miller | sudo | — | — |
| todd_miller | sudo | — | — |
| todd_miller | sudo | — | — |
| todd_miller | sudo | — | — |
| todd_miller | sudo | — | — |
| todd_miller | sudo | — | — |
| todd_miller | sudo | — | — |
CVSS provenance
nvdv2.04.4MEDIUMAV:L/AC:M/Au:N/C:P/I:P/A:P
osv4.4MEDIUM
vendor_redhat9.1CRITICAL
vendor_debian4.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-mxvj-5g45-2vv5: check
ghsa_unreviewed·2022-05-03
CVE-2011-0010 [MEDIUM] GHSA-mxvj-5g45-2vv5: check
check.c in sudo 1.7.x before 1.7.4p5, when a Runas group is configured, does not require a password for command execution that involves a gid change but no uid change, which allows local users to bypass an intended authentication requirement via the -g option to a sudo command.
OSV
CVE-2011-0010: check
osv·2011-01-18·CVSS 4.4
CVE-2011-0010 [MEDIUM] CVE-2011-0010: check
check.c in sudo 1.7.x before 1.7.4p5, when a Runas group is configured, does not require a password for command execution that involves a gid change but no uid change, which allows local users to bypass an intended authentication requirement via the -g option to a sudo command.
Red Hat
kernel: bpf: Fix a btf decl_tag bug when tagging a function
vendor_redhat·2025-02-26·CVSS 5.5
CVE-2022-49228 [MEDIUM] kernel: bpf: Fix a btf decl_tag bug when tagging a function
kernel: bpf: Fix a btf decl_tag bug when tagging a function
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix a btf decl_tag bug when tagging a function
syzbot reported a btf decl_tag bug with stack trace below:
general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 0 PID: 3592 Comm: syz-executor914 Not tainted 5.16.0-syzkaller-11424-gb7892f7d5cb2 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:btf_type_vlen include/linux/btf.h:231 [inline]
RIP: 0010:btf_decl_tag_resolve+0x83e/0xaa0 kernel/bpf/btf.c:3910
...
Call Trace:
btf_resolve+0x251/0x1020 kernel/bpf/btf.c:4198
btf_check_all
Red Hat
kernel: ipmr,ip6mr: acquire RTNL before calling ip[6]mr_free_table() on failure path
vendor_redhat·2024-07-16·CVSS 5.5
CVE-2022-48810 [MEDIUM] CWE-414 kernel: ipmr,ip6mr: acquire RTNL before calling ip[6]mr_free_table() on failure path
kernel: ipmr,ip6mr: acquire RTNL before calling ip[6]mr_free_table() on failure path
In the Linux kernel, the following vulnerability has been resolved:
ipmr,ip6mr: acquire RTNL before calling ip[6]mr_free_table() on failure path
ip[6]mr_free_table() can only be called under RTNL lock.
RTNL: assertion failed at net/core/dev.c (10367)
WARNING: CPU: 1 PID: 5890 at net/core/dev.c:10367 unregister_netdevice_many+0x1246/0x1850 net/core/dev.c:10367
Modules linked in:
CPU: 1 PID: 5890 Comm: syz-executor.2 Not tainted 5.16.0-syzkaller-11627-g422ee58dc0ef #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:unregister_netdevice_many+0x1246/0x1850 net/core/dev.c:10367
Code: 0f 85 9b ee ff ff e8 69 07 4b fa ba 7f 28 00 00 48 c7 c6 00 90 ae 8a 48 c7 c
Red Hat
kernel: fs/proc: task_mmu.c: don't read mapcount for migration entry
vendor_redhat·2024-07-16·CVSS 5.5
CVE-2022-48802 [MEDIUM] kernel: fs/proc: task_mmu.c: don't read mapcount for migration entry
kernel: fs/proc: task_mmu.c: don't read mapcount for migration entry
In the Linux kernel, the following vulnerability has been resolved:
fs/proc: task_mmu.c: don't read mapcount for migration entry
The syzbot reported the below BUG:
kernel BUG at include/linux/page-flags.h:785!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 4392 Comm: syz-executor560 Not tainted 5.16.0-rc6-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:PageDoubleMap include/linux/page-flags.h:785 [inline]
RIP: 0010:__page_mapcount+0x2d2/0x350 mm/util.c:744
Call Trace:
page_mapcount include/linux/mm.h:837 [inline]
smaps_account+0x470/0xb10 fs/proc/task_mmu.c:466
smaps_pte_entry fs/proc/task_mmu.c:538 [inline]
smaps_pte_range+0x611/0x1250 fs/proc/tas
Red Hat
kernel: sch_cake: do not call cake_destroy() from cake_init()
vendor_redhat·2024-06-19·CVSS 7.8
CVE-2021-47598 [HIGH] CWE-416 kernel: sch_cake: do not call cake_destroy() from cake_init()
kernel: sch_cake: do not call cake_destroy() from cake_init()
In the Linux kernel, the following vulnerability has been resolved:
sch_cake: do not call cake_destroy() from cake_init()
qdiscs are not supposed to call their own destroy() method
from init(), because core stack already does that.
syzbot was able to trigger use after free:
DEBUG_LOCKS_WARN_ON(lock->magic != lock)
WARNING: CPU: 0 PID: 21902 at kernel/locking/mutex.c:586 __mutex_lock_common kernel/locking/mutex.c:586 [inline]
WARNING: CPU: 0 PID: 21902 at kernel/locking/mutex.c:586 __mutex_lock+0x9ec/0x12f0 kernel/locking/mutex.c:740
Modules linked in:
CPU: 0 PID: 21902 Comm: syz-executor189 Not tainted 5.16.0-rc4-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:__m
Red Hat
kernel: bpf: Add oversize check before call kvcalloc()
vendor_redhat·2024-05-21·CVSS 5.5
CVE-2021-47376 [MEDIUM] kernel: bpf: Add oversize check before call kvcalloc()
kernel: bpf: Add oversize check before call kvcalloc()
In the Linux kernel, the following vulnerability has been resolved:
bpf: Add oversize check before call kvcalloc()
Commit 7661809d493b ("mm: don't allow oversized kvmalloc() calls") add the
oversize check. When the allocation is larger than what kmalloc() supports,
the following warning triggered:
WARNING: CPU: 0 PID: 8408 at mm/util.c:597 kvmalloc_node+0x108/0x110 mm/util.c:597
Modules linked in:
CPU: 0 PID: 8408 Comm: syz-executor221 Not tainted 5.14.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:kvmalloc_node+0x108/0x110 mm/util.c:597
Call Trace:
kvmalloc include/linux/mm.h:806 [inline]
kvmalloc_array include/linux/mm.h:824 [inline]
kvcalloc include/linux/mm.h:829
Red Hat
kernel: netfilter: divide error in nft_limit_init
vendor_redhat·2024-02-27·CVSS 5.5
CVE-2021-46915 [MEDIUM] CWE-369 kernel: netfilter: divide error in nft_limit_init
kernel: netfilter: divide error in nft_limit_init
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nft_limit: avoid possible divide error in nft_limit_init
div_u64() divides u64 by u32.
nft_limit_init() wants to divide u64 by u64, use the appropriate
math function (div64_u64)
divide error: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 8390 Comm: syz-executor188 Not tainted 5.12.0-rc4-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:div_u64_rem include/linux/math64.h:28 [inline]
RIP: 0010:div_u64 include/linux/math64.h:127 [inline]
RIP: 0010:nft_limit_init+0x2a2/0x5e0 net/netfilter/nft_limit.c:85
Code: ef 4c 01 eb 41 0f 92 c7 48 89 de e8 38 a5 22 fa 4d 85 ff 0f 85 97 02 00 00 e8 ea 9e 22 fa 4c 0f af f3
Red Hat
kernel: cifs: signedness issue in CIFSFindNext()
vendor_redhat·2011-08-23·CVSS 8.8
CVE-2011-3191 [HIGH] kernel: cifs: signedness issue in CIFSFindNext()
kernel: cifs: signedness issue in CIFSFindNext()
Integer signedness error in the CIFSFindNext function in fs/cifs/cifssmb.c in the Linux kernel before 3.1 allows remote CIFS servers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a large length value in a response to a read request for a directory.
Statement: This issue affects the Linux kernel as shipped with Red Hat Enterprise Linux 4, 5, 6, and Red Hat Enterprise MRG. It has been addressed in Red Hat Enterprise Linux 5, 6 and Red Hat Enterprise MRG via https://rhn.redhat.com/errata/RHSA-2011-1386.html, https://rhn.redhat.com/errata/RHSA-2011-1465.html, and https://rhn.redhat.com/errata/RHSA-2012-0010.html. Red Hat Enterprise Linux 4 is now in Production 3 of the maintenance life-cycle, ht
Red Hat
kernel: net: improve sequence number generation
vendor_redhat·2011-08-07·CVSS 9.1
CVE-2011-3188 [CRITICAL] kernel: net: improve sequence number generation
kernel: net: improve sequence number generation
The (1) IPv4 and (2) IPv6 implementations in the Linux kernel before 3.1 use a modified MD4 algorithm to generate sequence numbers and Fragment Identification values, which makes it easier for remote attackers to cause a denial of service (disrupted networking) or hijack network sessions by predicting these values and sending crafted packets.
Statement: This issue affects the Linux kernel as shipped with Red Hat Enterprise Linux 4, 5, 6, and Red Hat Enterprise MRG. It has been addressed in Red Hat Enterprise Linux 5, 6, and Red Hat Enterprise MRG via https://rhn.redhat.com/errata/RHSA-2011-1386.html, https://rhn.redhat.com/errata/RHSA-2011-1465.html, and https://rhn.redhat.com/errata/RHSA-2012-0010.html. Red Hat Enterprise Linux 4 is now in
Red Hat
kernel: b43: allocate receive buffers big enough for max frame len + offset
vendor_redhat·2011-03-27·CVSS 7.5
CVE-2011-3359 [HIGH] kernel: b43: allocate receive buffers big enough for max frame len + offset
kernel: b43: allocate receive buffers big enough for max frame len + offset
The dma_rx function in drivers/net/wireless/b43/dma.c in the Linux kernel before 2.6.39 does not properly allocate receive buffers, which allows remote attackers to cause a denial of service (system crash) via a crafted frame.
Statement: This issue did not affect the versions of the Linux kernel as shipped with Red
Hat Enterprise Linux 4 and 5 as they did not provide support for Broadcom 43xx wireless devices. This has been addressed in Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG via https://rhn.redhat.com/errata/RHSA-2011-1465.html, and https://rhn.redhat.com/errata/RHSA-2012-0010.html.
Package: kernel (Red Hat Enterprise Linux 4) - Not affected
Package: kernel (Red Hat Enterprise Linux 5) - Not affe
Ubuntu
Sudo vulnerability
vendor_ubuntu·2011-01-20
CVE-2011-0010 Sudo vulnerability
Title: Sudo vulnerability
Summary: Under certain circumstances, sudo could be made to run programs without
a password.
Alexander Kurtz discovered that sudo would not prompt for a password when
a group was specified in the Runas_Spec. A local attacker could exploit
this to execute arbitrary code as the specified group if sudo was
configured to allow the attacker to use a program as this group. The group
Runas_Spec is not used in the default installation of Ubuntu.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
sudo: does not ask for password on GID changes
vendor_redhat·2011-01-11·CVSS 4.4
CVE-2011-0010 [MEDIUM] sudo: does not ask for password on GID changes
sudo: does not ask for password on GID changes
check.c in sudo 1.7.x before 1.7.4p5, when a Runas group is configured, does not require a password for command execution that involves a gid change but no uid change, which allows local users to bypass an intended authentication requirement via the -g option to a sudo command.
Package: sudo (Red Hat Enterprise Linux 4) - Not affected
Debian
CVE-2011-0010: sudo - check.c in sudo 1.7.x before 1.7.4p5, when a Runas group is configured, does not...
vendor_debian·2011·CVSS 4.4
CVE-2011-0010 [MEDIUM] CVE-2011-0010: sudo - check.c in sudo 1.7.x before 1.7.4p5, when a Runas group is configured, does not...
check.c in sudo 1.7.x before 1.7.4p5, when a Runas group is configured, does not require a password for command execution that involves a gid change but no uid change, which allows local users to bypass an intended authentication requirement via the -g option to a sudo command.
Scope: local
bookworm: resolved (fixed in 1.7.4p4-6)
bullseye: resolved (fixed in 1.7.4p4-6)
forky: resolved (fixed in 1.7.4p4-6)
sid: resolved (fixed in 1.7.4p4-6)
trixie: resolved (fixed in 1.7.4p4-6)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-23379 kernel: net/sched: ets: fix divide by zero in the offload path
bugzilla·2026-03-25·CVSS 5.5
CVE-2026-23379 [MEDIUM] CVE-2026-23379 kernel: net/sched: ets: fix divide by zero in the offload path
CVE-2026-23379 kernel: net/sched: ets: fix divide by zero in the offload path
In the Linux kernel, the following vulnerability has been resolved:
net/sched: ets: fix divide by zero in the offload path
Offloading ETS requires computing each class' WRR weight: this is done by
averaging over the sums of quanta as 'q_sum' and 'q_psum'. Using unsigned
int, the same integer size as the individual DRR quanta, can overflow and
even cause division by zero, like it happened in the following splat:
Oops: divide error: 0000 [#1] SMP PTI
CPU: 13 UID: 0 PID: 487 Comm: tc Tainted: G E 6.19.0-virtme #45 PREEMPT(full)
Tainted: [E]=UNSIGNED_MODULE
Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
RIP: 0010:ets_offload_change+0x11f/0x290 [sch_ets]
Code: e4 45 31 ff eb 03 41 89 c7 41 89 cb 89 ce 83 f9 0f
Bugzilla
CVE-2021-46915 kernel: netfilter: divide error in nft_limit_init
bugzilla·2024-02-27·CVSS 5.5
CVE-2021-46915 [MEDIUM] CVE-2021-46915 kernel: netfilter: divide error in nft_limit_init
CVE-2021-46915 kernel: netfilter: divide error in nft_limit_init
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nft_limit: avoid possible divide error in nft_limit_init
div_u64() divides u64 by u32.
nft_limit_init() wants to divide u64 by u64, use the appropriate
math function (div64_u64)
divide error: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 8390 Comm: syz-executor188 Not tainted 5.12.0-rc4-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:div_u64_rem include/linux/math64.h:28 [inline]
RIP: 0010:div_u64 include/linux/math64.h:127 [inline]
RIP: 0010:nft_limit_init+0x2a2/0x5e0 net/netfilter/nft_limit.c:85
Code: ef 4c 01 eb 41 0f 92 c7 48 89 de e8 38 a5 22 fa 4d 85 ff 0f 85 97 02 00 00 e8 ea 9e
Bugzilla
CVE-2011-0010 sudo: does not ask for password on GID changes [fedora-all]
bugzilla·2011-01-13·CVSS 4.4
CVE-2011-0010 [MEDIUM] CVE-2011-0010 sudo: does not ask for password on GID changes [fedora-all]
CVE-2011-0010 sudo: does not ask for password on GID changes [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected Fedora
versions.
For comments that are specific to the vulnerability please use bugs filed
against "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please include the bug IDs of the
respective parent bugs filed against the "Security Response" product.
Please mention CVE ids in the RPM changelog when available.
Bodhi update submission link:
https://admin.fedoraproject.org/updates/new/?type_=security&bugs=668879
Please note: this issue affects multiple
Bugzilla
CVE-2011-0010 sudo: does not ask for password on GID changes
bugzilla·2011-01-11·CVSS 4.4
CVE-2011-0010 [MEDIUM] CVE-2011-0010 sudo: does not ask for password on GID changes
CVE-2011-0010 sudo: does not ask for password on GID changes
A Debian bug report [1] indicated that sudo would not ask for a user's password on GID changes, when it should be asking on both UID and GID changes. Normally, sudo does not allow users to change the GID only, but this can be changed by modifying /etc/sudoers to a non-default configuration, such as:
%group ALL=(ALL:ALL) ALL
rather than the more traditional:
%group ALL=(ALL) ALL
If you change the UID with sudo, you are asked for the user's password (unless NOPASSWD is specified), but this is not the case for GID changing:
$ sudo -l
[sudo] password for vdanen:
Matching Defaults entries for vdanen on this host:
requiretty, always_set_home, env_reset, env_keep="COLORS DISPLAY HOSTNAME
HISTSIZE INPUTRC KDEDIR LS_COLORS", env_kee
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=609641http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053263.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2011-January/053341.htmlhttp://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.htmlhttp://openwall.com/lists/oss-security/2011/01/11/3http://openwall.com/lists/oss-security/2011/01/12/1http://openwall.com/lists/oss-security/2011/01/12/3http://secunia.com/advisories/42886http://secunia.com/advisories/42949http://secunia.com/advisories/42968http://secunia.com/advisories/43068http://secunia.com/advisories/43282http://security.gentoo.org/glsa/glsa-201203-06.xmlhttp://slackware.com/security/viewer.php?l=slackware-security&y=2011&m=slackware-security.593654http://www.mandriva.com/security/advisories?name=MDVSA-2011:018http://www.osvdb.org/70400http://www.redhat.com/support/errata/RHSA-2011-0599.htmlhttp://www.securityfocus.com/bid/45774http://www.sudo.ws/repos/sudo/rev/07d1b0ce530ehttp://www.sudo.ws/repos/sudo/rev/fe8a94f96542http://www.sudo.ws/sudo/alerts/runas_group_pw.htmlhttp://www.ubuntu.com/usn/USN-1046-1http://www.vupen.com/english/advisories/2011/0089http://www.vupen.com/english/advisories/2011/0182http://www.vupen.com/english/advisories/2011/0195http://www.vupen.com/english/advisories/2011/0199http://www.vupen.com/english/advisories/2011/0212http://www.vupen.com/english/advisories/2011/0362https://bugzilla.redhat.com/show_bug.cgi?id=668879https://exchange.xforce.ibmcloud.com/vulnerabilities/64636http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=609641http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053263.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2011-January/053341.htmlhttp://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.htmlhttp://openwall.com/lists/oss-security/2011/01/11/3http://openwall.com/lists/oss-security/2011/01/12/1http://openwall.com/lists/oss-security/2011/01/12/3http://secunia.com/advisories/42886http://secunia.com/advisories/42949http://secunia.com/advisories/42968http://secunia.com/advisories/43068http://secunia.com/advisories/43282http://security.gentoo.org/glsa/glsa-201203-06.xmlhttp://slackware.com/security/viewer.php?l=slackware-security&y=2011&m=slackware-security.593654http://www.mandriva.com/security/advisories?name=MDVSA-2011:018http://www.osvdb.org/70400http://www.redhat.com/support/errata/RHSA-2011-0599.htmlhttp://www.securityfocus.com/bid/45774http://www.sudo.ws/repos/sudo/rev/07d1b0ce530ehttp://www.sudo.ws/repos/sudo/rev/fe8a94f96542http://www.sudo.ws/sudo/alerts/runas_group_pw.htmlhttp://www.ubuntu.com/usn/USN-1046-1http://www.vupen.com/english/advisories/2011/0089http://www.vupen.com/english/advisories/2011/0182http://www.vupen.com/english/advisories/2011/0195http://www.vupen.com/english/advisories/2011/0199http://www.vupen.com/english/advisories/2011/0212http://www.vupen.com/english/advisories/2011/0362https://bugzilla.redhat.com/show_bug.cgi?id=668879https://exchange.xforce.ibmcloud.com/vulnerabilities/64636
2011-01-18
Published