CVE-2022-42717: 
Packer vulnerability analysis and mitigation

The vulnerability (CVE-2022-42717) was discovered in HashiCorp Vagrant versions before 2.3.1, affecting the recommended sudoers configuration for NFS on Linux systems. The vulnerability was disclosed on October 10, 2022, and it allows for local privilege escalation on Linux hosts that have implemented the previously recommended sudoers configuration for Vagrant's NFS shared folders functionality (HashiCorp Discuss).

The vulnerability stems from an insecure wildcard in the sudoers configuration that was recommended in Vagrant's documentation for NFS driver on Linux. This configuration was designed to remove the need for vagrant users to type their password when starting a Vagrant guest. However, the implementation allowed non-privileged users on the host to leverage the wildcard in the sudoers configuration to execute arbitrary commands with root privileges (HashiCorp Discuss).

The vulnerability enables local privilege escalation, allowing non-privileged users on affected Linux hosts to execute arbitrary commands with root privileges. This could potentially lead to complete system compromise by local users (HashiCorp Discuss).

Users should update to Vagrant version 2.3.1 or later and follow the new instructions in the documentation for configuring their host's sudoers file. The update includes changes to support new recommendations and addresses the security vulnerability by implementing a more secure sudoers configuration (HashiCorp Discuss).