Prior to sudo 1.8.12, the
TZ environment variable was passed through
unchecked. Most libc
tzset() implementations support passing an
absolute pathname in the time zone to point to an arbitrary,
user-controlled file. This may be used to exploit bugs in the C
TZ parser or open files the user would not otherwise have
access to. Arbitrary file access via
TZ could also be used in a
denial of service attack by reading from a file or fifo that will
Beginning with sudo 1.8.12,
TZ is only passed through by default
if it is considered safe.
TZ variable is now considered unsafe if any of the following
It consists of a fully-qualified path name, optionally prefixed with a colon (
:), that does not match the location of the
It contains a
It contains white space or non-printable characters.
It is longer than the value of
Sudo versions prior to 1.8.12 are affected.
Unix systems support a user-specified time zone value stored in the
TZ environment variable. On many systems, the value of
TZ is ignored
for set user ID processes (such as sudo) if it does not pass certain
sanity checks. However, while the value may be ignored, it is not
actually removed from the environment. As such, a program run via
sudo will inherit the (possibly malicious) value of
A user with sudo access may take advantage of this to exploit bugs
in the C library functions which parse the
TZ environment variable.
TZ handling in most C libraries (including GNU libc and the
tzcode used by BSD and others) supports reading arbitrary files.
TZ to a fully-qualified path name, a command run via
sudo may be used to read (but not disclose the contents of) files
that the user would not otherwise be able to open. This is generally
benign for regular files, but it may be possible to change the
behavior of the system by reading from device special files. For
instance, it may be possible to hijack the output from a terminal
device file, consume kernel log messages or cause a tape drive to
change position. It may also be possible to cause a command run
by sudo to hang if
TZ is set to the value of a named pipe or a
device special file that blocks on read.
A user with sudo access may be able to exploit parsing bugs in the time zone parsing functions of the system’s C library functions. The user may also be able to read arbitrary files, potentially causing changes in system behavior when reading certain device special files or simply causing the program run via sudo to block.
The bug is fixed in sudo 1.8.12 and 1.7.10p9.
Jakub Wilk began a discussion about abusing the
variable on the oss-security mailing list.
Stephane Chazelas also reported the problem and supplied some concrete examples of how it could be abused.