Sudo through 1.9.17p2 fails to apply intercept policy checks to the execveat system call in ptrace-based intercept mode. Users permitted to run specific commands can execute denied programs by calling execveat directly or through fexecve, bypassing policy enforcement and logging.
CVSS Details
- CVSS 4.0 Base Score: 8.5 (HIGH)
- CVSS 4.0 Vector: (CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade sudoUpgrade sudo-python-plugin | Oct 11, 2026 | Sep 21, 2026 |
| Oracle_linux | — | Upgrade sudoUpgrade sudo-python-plugin | Oct 22, 2026 | Aug 29, 2026 |
| Redhat_linux | — | Upgrade sudo-python-plugin-debuginfoUpgrade sudo-python-pluginUpgrade sudo-debugsourceUpgrade sudo-debuginfoUpgrade sudo | Sep 9, 2026 | Aug 29, 2026 |
| Rocky_linux | — | Upgrade sudo-python-plugin-debuginfoUpgrade sudoUpgrade sudo-python-pluginUpgrade sudo-debugsourceUpgrade sudo-debuginfo | Sep 23, 2026 | Sep 19, 2026 |
| Ubuntu | — | Upgrade sudoUpgrade sudo-ldap | Sep 23, 2026 | Sep 22, 2026 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub