CVE-2018-10852

What it actually does

The UNIX pipe used by sudo to retrieve sudo rules from SSSD has overly permissive access, allowing any local process using the same raw protocol to read rules for any user.

Why it matters to the business

Attackers on the same system can discover elevated privileges and potential targets for further compromise, increasing risk of unauthorized access across the environment.

How an attack unfolds

An attacker on a system using vulnerable SSSD sends crafted messages over the world-readable pipe that sudo uses to query SSSD, retrieving the full set of sudo rules available for every user without authentication.

How to fix it

Upgrade SSSD to version 1.16.3 or later. For the listed Alpine irssi packages, update to the fixed version 1.1.2-r0.

How to confirm the fix worked

Confirm SSSD version is at least 1.16.3 and verify pipe permissions are restricted to root or the sudo group only.

Typical attack path

1. Gain local shell access on a host running vulnerable SSSD
2. Identify the sudo-SSSD pipe path
3. Craft and send protocol messages matching sudo's format
4. Receive and parse sudo rules for any user
5. Identify accounts with elevated privileges for follow-on attacks

How to detect it

Review system logs for unexpected processes opening or writing to the sudo-SSSD pipe; inspect process listings and pipe permissions during forensic sweeps.

• /var/lib/sss/pipes/sudo
• unexpected processes communicating over sudo pipe

What your security team should do

• Prioritize patching SSSD on all systems using sudo integration
• Audit local privilege-escalation paths that could leverage exposed rules
• Monitor for unexpected local processes accessing the sudo-SSSD pipe