sudo-rs Allows Low Privilege Users to Enumerate Privileges of Others

The vulnerability resides in sudo-rs, a memory-safe sudo implementation in Rust. Prior to version 0.2.6, the -U flag, intended to list another user's privileges, is not properly restricted for users with limited sudo rights. This allows an attacker to query the full sudoers file for any user, contrary to the original sudo which denies this operation for non-allowed users [2][3].

Exploitation requires the attacker to possess at least some sudo privileges on the system (e.g., execution of a single command like ps). By running sudo -l -U , the attacker can retrieve the complete sudo rules for the target user. The original sudo correctly blocks this with an error, but sudo-rs prior to 0.2.6 does not [3]. This behavior was confirmed in versions up to 0.2.5 [3].

The impact is information disclosure: an attacker can enumerate all users' sudo permissions, revealing which commands other users can execute with elevated privileges. This intelligence can be used to plan more targeted attacks, such as privilege escalation or lateral movement. Systems where users have no sudo access or have unrestricted root access are not vulnerable [2][3].

A fix was released in version 0.2.6, which introduces a list pseudocommand to control sudo -U and adds proper authorization checks [4]. All users running sudo-rs versions below 0.2.6 should upgrade immediately to mitigate this vulnerability.