CVE-2015-8239

HIGH
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2015-8239 has a selected CVSS score of 7.0 (high); EIP currently links 1 repository PoC and 1 lab environment.

Description

The SHA-2 digest support in the sudoers plugin in sudo after 1.8.7 allows local users with write permissions to parts of the called command to replace them before it is executed.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1
Lab environments
1

Proofs of concept

1

Repository PoCs

GitHubjustinsteven/sudo_digest_toctou_poc_CVE-2015-8239Repository PoCby justinsteven0Not analyzed9 files

9.4 KiB

GitHub
PoC details

Docker lab environments

1
GitHub

Repository root

justinsteven/sudo_digest_toctou_poc_CVE-2015-8239Created Vuln labCVE-2015-8239Dockerfile

1 Dockerfile

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker-based proof-of-concept environment demonstrating a TOCTOU race condition in sudo's Digest_Spec feature (CVE-2015-8239). It sets up a Debian container with two users (editor and executor), a sudoers rule that allows executor to run /opt/sudoable only if its SHA256 hash matches a specific value, and an inotify-based exploit script that the editor user can run to replace the file during execution, bypassing the hash check.

README.md:1-151Dockerfile:1-20

Lab assessment

Vulnerability lab

The README explicitly states the project is a POC for CVE-2015-8239, a TOCTOU race condition in sudo's Digest_Spec. The Dockerfile and exploit script are designed to reproduce the vulnerability in a controlled containerized environment.

README.md:1-5README.md:7-11
Lab shapeDockerfile
ServicesUnknown
Compose manifests0
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

Dockerfile

environment definition

Defines a Debian stable image, installs python3-pyinotify, sudo, and tmux, creates editor and executor users, copies hello, goodbye, sudoable (a copy of hello), and the exploit script, and configures sudoers to allow executor to run /opt/sudoable only if its SHA256 matches the hash of /opt/hello.

Dockerfile:1-20

sudoers_sudoable.tmpl

sudo configuration template

Template for a sudoers file that defines a command alias WOOTWOOT requiring a specific SHA256 hash for /opt/sudoable, and allows the executor user to run it without a password. The hash placeholder is replaced during build with the actual hash of /opt/sudoable.

sudoers_sudoable.tmpl:1-2Dockerfile:18-19

exploit.py

exploit script

A Python script using pyinotify to monitor /opt/sudoable. On file access (IN_ACCESS), it attempts to replace the file with /opt/goodbye (the malicious binary). On file close (IN_CLOSE_NOWRITE), it replaces it back with /opt/hello (the legitimate binary). This exploits the TOCTOU race condition to execute arbitrary code as root.

exploit/exploit.py:1-68

instantiate.sh

container launcher

A shell script that runs the pre-built Docker image justinsteven/sudo_digest_race with a bind mount of the local exploit directory into /home/editor/exploit, providing an interactive bash shell.

instantiate.sh:1-3

hello and goodbye binaries

legitimate and malicious payloads

BINARY files (hello.c and goodbye.c source not included in evidence). hello is the legitimate program whose hash is allowed by sudoers; goodbye is the malicious replacement. Their behavior is uninspected.

Dockerfile:9-10
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2015-8239

Supported by supplied evidence

The README explicitly states the project is a POC for CVE-2015-8239, a TOCTOU race condition in sudo's Digest_Spec. The Dockerfile and exploit script are designed to reproduce this exact vulnerability by racing file replacement against sudo's hash verification.

README.md:3-11exploit/exploit.py:1-68
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker must be installed to build and run the image.README.md:55instantiate.sh:3
  • The user must have root or sudo access on the Docker host to run the container.instantiate.sh:3
  • The exploit requires the editor user to run exploit.py while the executor user repeatedly runs sudo /opt/sudoable.README.md:59-67

Evidence-described exercise path

  1. Build the Docker image using 'make all'.README.md:55
  2. Run the container with './instantiate.sh'.README.md:59
  3. Inside the container, start a tmux session with two panes.README.md:60
  4. In the top pane, run 'sudo -u executor sudo /opt/sudoable' to observe the legitimate output 'Hello uid=0'.README.md:61
  5. In the bottom pane, replace /opt/sudoable with the malicious binary using 'sudo -u editor cp /opt/goodbye /opt/sudoable'.README.md:62
  6. In the top pane, attempt to run 'sudo -u executor sudo /opt/sudoable' again; it should fail with a password prompt due to hash mismatch.README.md:63
  7. In the bottom pane, start the exploit with 'sudo -u editor /home/editor/exploit/exploit.py'.README.md:64
  8. In the top pane, repeatedly run 'sudo -u executor sudo /opt/sudoable' and observe occasional 'Goodbye uid=0' output, indicating successful exploitation.README.md:65
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is directed at the lab's own target inside the container. The exploit script replaces a file within the container to demonstrate privilege escalation from editor to root, which is the documented purpose of the vulnerability lab. There is no evidence of host escape, external connections, persistence, credential theft, or destructive behavior beyond the intended demonstration.

exploit/exploit.py:1-68Dockerfile:1-20instantiate.sh:1-3
Review boundaries

What the analysis did not establish

  • The hello and goodbye binaries are uninspected; their source code (hello.c, goodbye.c) is not included in the evidence packet.
  • The Makefile is not included in the evidence files, so the exact build process for the binaries is unknown.
  • The instantiate.sh script uses a pre-built image (justinsteven/sudo_digest_race) rather than building from the local Dockerfile, but the Dockerfile is provided for reference.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

References

6