CVE-2023-42456
LowCVSS 3.3Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
In versions of sudo-rs prior to 0.2.1, an issue was discovered where usernames containing '.' and '/' characters could lead to corruption of specific files on the filesystem. A user with such a name could delete a binary file, resulting in its removal from the system.
Risk Assessment
An attacker who gains access to the system as a user with a specially crafted username could remove critical binary files, leading to serious security and stability issues.
Recommendation
It is recommended to upgrade to version 0.2.1 of sudo-rs to eliminate this vulnerability. Additionally, ensure that there are no users with specially crafted usernames on the system.
Other vulnerabilities in sudo-rs
See all- CVE-2025-64517Medium
sudo-rs is a memory-safe implementation of sudo and su written in Rust. With `Defaults targetpw` (or `Defaults rootpw`) enabled, sudo-rs versions 0.2.5 through before 0.2.10 incorrectly recorded the invoking user's UID instead of the authenticated-as user's UID in the authentication timestamp. A later sudo invocation on the same terminal while the timestamp was still valid could use it and bypass required re-authentication. Version 0.2.10 contains a patch; versions prior to 0.2.5 are not affected because they do not offer these options.
- CVE-2025-64170Low
In sudo-rs (a memory-safe sudo and su implementation in Rust) versions 0.2.7 prior to 0.2.10, if a user begins entering a password but does not press return for an extended period, a password timeout may occur and the entered keystrokes are echoed back to the console. This could reveal partial password information, potentially exposing history files and enabling social engineering or pass-by attacks. Version 0.2.10 fixes the issue.
Original NVD description (English source)
Sudo-rs, a memory safe implementation of sudo and su, allows users to not have to enter authentication at every sudo attempt, but instead only requiring authentication every once in a while in every terminal or process group. Only once a configurable timeout has passed will the user have to re-authenticate themselves. Supporting this functionality is a set of session files (timestamps) for each user, stored in `/var/run/sudo-rs/ts`. These files are named according to the username from which the sudo attempt is made (the origin user). An issue was discovered in versions prior to 0.2.1 where usernames containing the `.` and `/` characters could result in the corruption of specific files on the filesystem. As usernames are generally not limited by the characters they can contain, a username appearing to be a relative path can be constructed. For example we could add a user to the system containing the username `../../../../bin/cp`. When logged in as a user with that name, that user could run `sudo -K` to clear their session record file. The session code then constructs the path to the session file by concatenating the username to the session file storage directory, resulting in a resolved path of `/bin/cp`. The code then clears that file, resulting in the `cp` binary effectively being removed from the system. An attacker needs to be able to login as a user with a constructed username. Given that such a username is unlikely to exist on an existing system, they will also need to be able to create the users with the constructed usernames. The issue is patched in version 0.2.1 of sudo-rs. Sudo-rs now uses the uid for the user instead of their username for determining the filename. Note that an upgrade to this version will result in existing session files being ignored and users will be forced to re-authenticate. It also fully eliminates any possibility of path traversal, given that uids are always integer values. The `sudo -K` and `sudo -k` commands can run, even if a user has no sudo access. As a workaround, make sure that one's system does not contain any users with a specially crafted username. While this is the case and while untrusted users do not have the ability to create arbitrary users on the system, one should not be able to exploit this issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS