CVE-2023-42465: 
NixOS vulnerability analysis and mitigation

CVE-2023-42465 affects Sudo versions before 1.9.15, where a vulnerability exists that could allow row hammer attacks for authentication bypass or privilege escalation. The vulnerability stems from application logic that bases decisions on not equaling an error value instead of equaling a success value, and because the values used do not resist flips of a single bit (NVD, MITRE).

The vulnerability involves the potential for bit flips in stack and register variables through fault injection, which can affect execution flow in security-sensitive code. The issue specifically relates to how authentication checks were implemented, where code would check if a value was not equal to an error state rather than explicitly checking for a success state. This implementation made the system susceptible to row hammer attacks that could flip bits in memory (ArXiv Paper). The vulnerability has a CVSS v3.1 base score of 7.0 (HIGH) with vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD).

Successful exploitation of this vulnerability could lead to authentication bypass or privilege escalation. An attacker could potentially gain unauthorized access or elevated privileges by manipulating memory bits through row hammer attacks (Gentoo Advisory, NetApp Advisory).

The vulnerability has been fixed in Sudo version 1.9.15 and later. The fix involves using ROWHAMMER-resistant values for authentication states (ALLOW, DENY, AUTH_SUCCESS, AUTH_FAILURE, AUTH_ERROR, and AUTH_NONINTERACTIVE) and implementing explicit checks for expected values instead of using negated tests against error values (Sudo Release). Users are advised to upgrade to the latest version of Sudo to protect against this vulnerability.

The vulnerability was discovered by researchers from the Vernam Applied Cryptography and Cybersecurity Lab at Worcester Polytechnic Institute. The discovery led to various Linux distributions releasing security advisories and patches, including Fedora and Gentoo (Fedora Update, Gentoo Advisory).