CVE-2023-22809
HighCVSS 7.8Summary
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environment variables (SUDO_EDITOR, VISUAL, and EDITOR), allowing a local attacker to append arbitrary entries to the list of files to process. This can lead to privilege escalation. Affected versions are 1.8.0 through 1.9.12.p1. The problem exists because a user-specified editor may contain a "--" argument that defeats a protection mechanism, e.g., an EDITOR='vim -- /path/to/extra/file' value.
Risk Assessment
A local attacker with limited privileges can gain root privileges by editing arbitrary files via sudoedit. This poses a serious threat to system confidentiality, integrity, and availability.
Recommendation
Update Sudo to version 1.9.12p2 or later. Restrict sudoedit access to users who do not require it for their duties.
Other vulnerabilities in Sudo
See all- CVE-2017-1000368High
Todd Miller's sudo version 1.8.20p1 and earlier is vulnerable to input validation (embedded newlines) in the get_process_ttyname() function resulting in information disclosure and command execution.
- CVE-2016-7032High
Sudo versions before 1.8.15 on Linux contain a vulnerability that may allow local users to bypass noexec command restrictions via applications calling the system or popen functions.
- CVE-2017-2381High
An issue was discovered in certain Apple products, including macOS before 10.12.4, related to the 'sudo' component. It allows remote authenticated users to gain privileges by leveraging membership in the admin group on a network directory server.
- CVE-2015-5602High
A vulnerability in sudoedit before version 1.8.15 allows local users to gain privileges via a symlink attack on a file whose full path is defined using multiple wildcards in /etc/sudoers.
- CVE-2025-32463CriticalActively exploited
Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option.
- CVE-2021-3156HighActively exploited
Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow. This allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character.
- CVE-2026-96512High
A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based restrictions with timestamps lacking the trailing 'Z', time evaluation relies on the TZ environment variable. An unprivileged local user can set TZ to an extreme offset, shifting the authorization window by up to ~25 hours, allowing command execution outside the intended time window.
- CVE-2026-82474High
Sudo through version 1.9.17p2 fails to apply intercept policy checks to the execveat system call in ptrace-based intercept mode. Users permitted to run specific commands can execute denied programs by calling execveat directly or through fexecve, bypassing policy enforcement and logging.
- CVE-2026-35535High
In Sudo up to version 1.9.17p2 before commit 3e474c2, a failure of setuid, setgid, or setgroups calls during privilege drop before running the mailer is not a fatal error, which can lead to privilege escalation.
- CVE-2025-32462Low
A vulnerability in Sudo before version 1.9.17p1 allows listed users in the sudoers file to execute commands on unintended machines when the file specifies a host that is neither the current host nor ALL.
Original NVD description (English source)
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environment variables (SUDO_EDITOR, VISUAL, and EDITOR), allowing a local attacker to append arbitrary entries to the list of files to process. This can lead to privilege escalation. Affected versions are 1.8.0 through 1.9.12.p1. The problem exists because a user-specified editor may contain a "--" argument that defeats a protection mechanism, e.g., an EDITOR='vim -- /path/to/extra/file' value.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS