Infinera G42 Sudoers Misconfiguration Vulnerability Allowing Memory Access and Privilege Escalation

A misconfiguration in the sudoers file of Infinera G42 version R6.1.3 enables low-privileged operating system users to read and write physical memory using the devmem command line tool. This vulnerability could lead to unauthorized disclosure of sensitive information, denial of service, and privilege escalation by manipulating kernel memory. The sudo -l command reveals that devmem can be executed as a superuser without a password, allowing access to arbitrary memory areas by specifying absolute addresses.

Impact

Exploitation of this vulnerability could result in unauthorized access to physical memory, allowing for sensitive information disclosure, disruption of services, and unauthorized privilege escalation by tampering with kernel memory.