Version of sudo  [Solved]

For questions regarding system and application security
Forum rules
Post Reply
Message
Author
bitfikler
Posts: 83
Joined: Tue Mar 06, 2018 7:04 pm

Version of sudo

#1 Post by bitfikler »

Hi!
Lately there has been some fuzz about sudo version and today I found this on facebook:


Image


Version should be at least 1.17P1 or later according to this post.

My version of sudo is like this:

Code: Select all

$ sudo -V
Sudo version 1.9.5p2
Sudoers policy plugin version 1.9.5p2
Sudoers file grammar version 48
Sudoers I/O plugin version 1.9.5p2
Sudoers audit plugin version 1.9.5p2
Should I be worried?

My system:

Code: Select all

Snapshot created on: 20240406_1441
System:    Kernel: 6.12.6-1-liquorix-amd64 [6.12-7~mx21ahs+1] x86_64 bits: 64 compiler: gcc v: 10.2.1 
           parameters: audit=0 intel_pstate=disable amd_pstate=disable 
           BOOT_IMAGE=/boot/vmlinuz-6.12.6-1-liquorix-amd64 root=UUID=<filter> ro 
           Desktop: Xfce 4.18.1 tk: Gtk 3.24.24 info: xfce4-panel wm: xfwm 4.18.0 vt: 7 
           dm: LightDM 1.26.0 Distro: MX-21.3_x64 Wildflower June 18  2023 
           base: Debian GNU/Linux 11 (bullseye) 
Machine:   Type: Laptop System: LENOVO product: 20BHS04T05 v: ThinkPad W540 serial: <filter> 
           Chassis: type: 10 serial: <filter> 
           Mobo: LENOVO model: 20BHS04T05 v: 0B98401 Pro serial: <filter> UEFI-[Legacy]: LENOVO 
           v: GNET61WW (2.09 ) date: 02/18/2014 
Battery:   ID-1: BAT0 charge: 40.1 Wh (100.0%) condition: 40.1/56.2 Wh (71.5%) volts: 12.3 
           min: 10.8 model: SANYO 45N1769 type: Li-ion serial: <filter> status: Full 
           Device-1: hidpp_battery_0 model: Logitech Marathon Mouse/Performance Plus M705 
           serial: <filter> charge: 55% (should be ignored) rechargeable: yes status: Discharging 
CPU:       Info: Quad Core model: Intel Core i7-4800MQ bits: 64 type: MT MCP arch: Haswell 
           family: 6 model-id: 3C (60) stepping: 3 microcode: 28 cache: L2: 6 MiB 
           flags: avx avx2 lm nx pae sse sse2 sse3 sse4_1 sse4_2 ssse3 vmx bogomips: 43101 
           Speed: 3047 MHz min/max: 800/2701 MHz boost: enabled Core speeds (MHz): 1: 2754 2: 1500 
           3: 2959 4: 800 5: 2926 6: 800 7: 2906 8: 2701 
           Vulnerabilities: Type: gather_data_sampling status: Not affected 
           Type: itlb_multihit status: KVM: VMX disabled 
           Type: l1tf mitigation: PTE Inversion; VMX: conditional cache flushes, SMT vulnerable 
           Type: mds mitigation: Clear CPU buffers; SMT vulnerable 
           Type: meltdown mitigation: PTI 
           Type: mmio_stale_data status: Unknown: No mitigations 
           Type: reg_file_data_sampling status: Not affected 
           Type: retbleed status: Not affected 
           Type: spec_rstack_overflow status: Not affected 
           Type: spec_store_bypass mitigation: Speculative Store Bypass disabled via prctl 
           Type: spectre_v1 mitigation: usercopy/swapgs barriers and __user pointer sanitization 
           Type: spectre_v2 mitigation: Retpolines; IBPB: conditional; IBRS_FW; STIBP: 
           conditional; RSB filling; PBRSB-eIBRS: Not affected; BHI: Not affected 
           Type: srbds mitigation: Microcode 
           Type: tsx_async_abort status: Not affected 
Graphics:  Device-1: Intel 4th Gen Core Processor Integrated Graphics vendor: Lenovo driver: i915 
           v: kernel bus-ID: 00:02.0 chip-ID: 8086:0416 class-ID: 0300 
           Device-2: NVIDIA GK107GLM [Quadro K1100M] vendor: Lenovo driver: N/A alternate: nouveau 
           bus-ID: 01:00.0 chip-ID: 10de:0ff6 class-ID: 0300 
           Device-3: Lite-On Integrated Camera type: USB driver: uvcvideo bus-ID: 1-12:4 
           chip-ID: 04ca:7035 class-ID: 0e02 
           Display: x11 server: X.Org 1.20.14 compositor: xfwm4 v: 4.18.0 driver: 
           loaded: modesetting unloaded: fbdev,vesa display-ID: :0.0 screens: 1 
           Screen-1: 0 s-res: 1920x1080 s-dpi: 96 s-size: 508x285mm (20.0x11.2") 
           s-diag: 582mm (22.9") 
           Monitor-1: eDP-1 res: 1920x1080 hz: 60 dpi: 142 size: 344x193mm (13.5x7.6") 
           diag: 394mm (15.5") 
           OpenGL: renderer: Mesa Intel HD Graphics 4600 (HSW GT2) v: 4.6 Mesa 22.0.5 
           compat-v: 3.1 direct render: Yes 
Audio:     Device-1: Intel Xeon E3-1200 v3/4th Gen Core Processor HD Audio vendor: Lenovo 
           driver: snd_hda_intel v: kernel bus-ID: 00:03.0 chip-ID: 8086:0c0c class-ID: 0403 
           Device-2: Intel 8 Series/C220 Series High Definition Audio vendor: Lenovo 
           driver: snd_hda_intel v: kernel bus-ID: 00:1b.0 chip-ID: 8086:8c20 class-ID: 0403 
           Device-3: NVIDIA GK107 HDMI Audio vendor: Lenovo driver: snd_hda_intel v: kernel 
           bus-ID: 01:00.1 chip-ID: 10de:0e1b class-ID: 0403 
           Sound Server-1: ALSA v: k6.12.6-1-liquorix-amd64 running: yes 
           Sound Server-2: PulseAudio v: 14.2 running: yes 
Network:   Device-1: Intel Ethernet I217-LM vendor: Lenovo driver: e1000e v: kernel port: 5080 
           bus-ID: 00:19.0 chip-ID: 8086:153a class-ID: 0200 
           IF: eth0 state: down mac: <filter> 
           Device-2: Intel Centrino Advanced-N 6235 driver: iwlwifi v: kernel modules: wl 
           port: 4000 bus-ID: 03:00.0 chip-ID: 8086:088f class-ID: 0280 
           IF: wlan0 state: up mac: <filter> 
           IF-ID-1: nordlynx state: unknown speed: N/A duplex: N/A mac: N/A 
Bluetooth: Device-1: Intel Centrino Bluetooth Wireless Transceiver type: USB driver: btusb v: 0.8 
           bus-ID: 1-11:3 chip-ID: 8087:07da class-ID: e001 
           Report: hciconfig ID: hci0 rfk-id: 2 state: up address: <filter> bt-v: 2.1 lmp-v: 4.0 
           sub-v: fc00 hci-v: 4.0 rev: 1ebd 
           Info: acl-mtu: 310:10 sco-mtu: 64:8 link-policy: rswitch hold sniff park 
           link-mode: slave accept service-classes: rendering, capturing, object transfer, audio 
Drives:    Local Storage: total: 2.27 TiB used: 1.35 TiB (59.5%) 
           SMART Message: Unable to run smartctl. Root privileges required. 
           ID-1: /dev/sda maj-min: 8:0 vendor: Samsung model: SSD 870 EVO 500GB size: 465.76 GiB 
           block-size: physical: 512 B logical: 512 B speed: 6.0 Gb/s type: SSD serial: <filter> 
           rev: 2B6Q scheme: MBR 
           ID-2: /dev/sdb maj-min: 8:16 vendor: Samsung model: SSD 870 EVO 2TB size: 1.82 TiB 
           block-size: physical: 512 B logical: 512 B speed: 6.0 Gb/s type: SSD serial: <filter> 
           rev: 2B6Q scheme: MBR 
Partition: ID-1: / raw-size: 78.12 GiB size: 76.35 GiB (97.73%) used: 18.97 GiB (24.8%) fs: ext4 
           dev: /dev/sdb1 maj-min: 8:17 
           ID-2: /home raw-size: 1.74 TiB size: 1.71 TiB (98.37%) used: 1.06 TiB (61.8%) fs: ext4 
           dev: /dev/sdb3 maj-min: 8:19 
Swap:      Kernel: swappiness: 15 (default 60) cache-pressure: 100 (default) 
           ID-1: swap-1 type: partition size: 9 MiB used: 0 KiB (0.0%) priority: -2 dev: /dev/sdb2 
           maj-min: 8:18 
Sensors:   System Temperatures: cpu: 62.0 C mobo: N/A 
           Fan Speeds (RPM): fan-1: 2917 
Repos:     Packages: 2618 note: see --pkg apt: 2590 lib: 1337 flatpak: 28 
           No active apt repos in: /etc/apt/sources.list 
           Active apt repos in: /etc/apt/sources.list.d/brave-browser-release.list 
           1: deb [arch=amd64] https://brave-browser-apt-release.s3.brave.com/ bullseye main
           Active apt repos in: /etc/apt/sources.list.d/debian-stable-updates.list 
           1: deb http://deb.debian.org/debian bullseye-updates main contrib non-free
           Active apt repos in: /etc/apt/sources.list.d/debian.list 
           1: deb http://deb.debian.org/debian bullseye main contrib non-free
           2: deb http://security.debian.org/debian-security bullseye-security main contrib non-free
           Active apt repos in: /etc/apt/sources.list.d/megasync.list 
           1: deb [signed-by=/usr/share/keyrings/meganz-archive-keyring.gpg] https://mega.nz/linux/repo/Debian_11/ ./
           Active apt repos in: /etc/apt/sources.list.d/mx.list 
           1: deb http://mirrors.dotsrc.org/mx-packages/mx/repo/ bullseye main non-free
           2: deb http://mirrors.dotsrc.org/mx-packages/mx/repo/ bullseye ahs
           Active apt repos in: /etc/apt/sources.list.d/nordvpn.list 
           1: deb https://repo.nordvpn.com/deb/nordvpn/debian stable main
           Active apt repos in: /etc/apt/sources.list.d/signal-xenial-added-by-mxpi.list 
           1: deb [arch=amd64] https://updates.signal.org/desktop/apt xenial main
           Active apt repos in: /etc/apt/sources.list.d/syncthing.list 
           1: deb https://apt.syncthing.net/ syncthing stable
           Active apt repos in: /etc/apt/sources.list.d/teamviewer.list 
           1: deb [signed-by=/usr/share/keyrings/teamviewer-keyring.gpg] https://linux.teamviewer.com/deb stable main
           No active apt repos in: /etc/apt/sources.list.d/vivaldi.list 
Info:      Processes: 338 Uptime: 9h 10m wakeups: 22 Memory: 15.27 GiB used: 6.53 GiB (42.8%) 
           Init: SysVinit v: 2.96 runlevel: 5 default: 5 tool: systemctl Compilers: gcc: 10.2.1 
           alt: 10 Client: shell wrapper v: 5.1.4-release inxi: 3.3.06 
Boot Mode: BIOS (legacy, CSM, MBR)
Greetings from

Bitfikler
Top
User avatar
j2mcgreg
Global Moderator
Posts: 6919
Joined: Tue Oct 23, 2007 12:04 pm

Re: Version of sudo

#2 Post by j2mcgreg »

It's already been patched. See here:
viewtopic.php?p=824042&hilit=sudo#p824042
HP 15; ryzen 3 5300U APU; 500 Gb SSD; 8GB ram
HP 17; ryzen 3 3200; 500 GB SSD; 12 GB ram
Idea Center 3; 12 gen i5; 256 GB ssd;

In Linux, newer isn't always better. The best solution is the one that works.
Top
User avatar
dolphin_oracle
Developer
Posts: 22341
Joined: Sun Dec 16, 2007 12:17 pm

Re: Version of sudo  [Solved]

#3 Post by dolphin_oracle »

the one "serious" CVE was not technically patched in bullseye, but I think the code that is the problem doesn't exist in the bullseye version of sudo. the code was introduced later. the other two CVE's were considered minor hardening, and not really bugs.
http://www.youtube.com/runwiththedolphin
lenovo ThinkPad X1 Extreme Gen 4 - MX-23
FYI: mx "test" repo is not the same thing as debian testing repo.
Top
Post Reply

Return to “Security”