leviathan
270ddc1681
Adds tools/verify-vm/provisioners/<module>.sh hook so per-module setup
(build vulnerable sudo from source, drop polkit allow rule, add sudoers
grant) lives in checked-in scripts rather than manual VM steps. Vagrantfile
runs the script as root before build-and-verify if it exists.
Also fixes mainline kernel fetch to fall back from /v${KVER}/amd64/ to
/v${KVER}/ for old kernels (≤ ~4.15) where debs aren't under the amd64
subdir, and accepts both 'linux-image-' (old) and 'linux-image-unsigned-'
(new) deb names.
Wires up 4 previously-deferred targets to expect VULNERABLE:
- sudo_chwoot: builds sudo 1.9.16p1 from upstream into /usr/local
- udisks_libblockdev: installs udisks2 + polkit rule for vagrant user
- mutagen_astronomy: pins mainline 4.14.70 (one below the .71 fix)
- sudo_runas_neg1: adds (ALL,!root) sudoers grant
35 lines
1.6 KiB
Bash
Executable File
35 lines
1.6 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# CVE-2025-32463 sudo --chroot NSS injection (Stratascale). Vulnerable
|
|
# range is sudo [1.9.14, 1.9.17p0]. Ubuntu 22.04 ships 1.9.9 which
|
|
# PREDATES the --chroot code path. Build sudo 1.9.16p1 from upstream
|
|
# and install to /usr/local (which precedes /usr/bin in Ubuntu's default
|
|
# PATH so plain `sudo` resolves to the vulnerable binary).
|
|
set -e
|
|
|
|
export DEBIAN_FRONTEND=noninteractive
|
|
apt-get install -y -qq libpam0g-dev libssl-dev wget make gcc >/dev/null
|
|
|
|
cd /tmp
|
|
TARBALL=sudo-1.9.16p1.tar.gz
|
|
URL="https://www.sudo.ws/dist/${TARBALL}"
|
|
|
|
if [ -x /usr/local/bin/sudo ] && /usr/local/bin/sudo --version 2>&1 | head -1 | grep -q "1.9.16p1"; then
|
|
echo "[=] sudo 1.9.16p1 already at /usr/local/bin/sudo"
|
|
else
|
|
[ -f "${TARBALL}" ] || wget -q "${URL}"
|
|
rm -rf sudo-1.9.16p1
|
|
tar xzf "${TARBALL}"
|
|
cd sudo-1.9.16p1
|
|
# --sysconfdir=/etc so it honors the existing /etc/sudoers (vagrant's
|
|
# NOPASSWD grant). --disable-shared keeps the build self-contained.
|
|
./configure --prefix=/usr/local --sysconfdir=/etc \
|
|
--disable-shared --quiet >/dev/null 2>&1
|
|
make -j"$(nproc)" >/tmp/sudo-build.log 2>&1 || { tail -40 /tmp/sudo-build.log; exit 1; }
|
|
make install >/tmp/sudo-install.log 2>&1 || { tail -40 /tmp/sudo-install.log; exit 1; }
|
|
fi
|
|
|
|
# Verify what the unprivileged user's PATH resolves to.
|
|
echo "[+] which sudo (root): $(which sudo)"
|
|
echo "[+] /usr/local/bin/sudo version: $(/usr/local/bin/sudo --version | head -1)"
|
|
sudo -u vagrant bash -c 'echo "[+] vagrant PATH: $PATH"; echo "[+] vagrant sees: $(which sudo)"; sudo --version | head -1'
|