sudo project CVEs · No public exploit

Look up CVE IDs Status Exploitation Severity

Reset

Overview 15 matches · 0 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5

15matches 0in Waratek scope0.0% 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0% 0EPSS ≥ 0.50.0%

Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 4 26.7% Not applicable 11 73.3% Withdrawn CVE 0 0.0%

Critical 0 0.0% High 11 73.3% Medium 2 13.3% Low 2 13.3% None 0 0.0% Unknown 0 0.0%

blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 15 100.0% not established 0 0.0% unrecorded 0 0.0%

Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 15 100.0%

split by StatusSeverityProtectionExploit maturity peak 5 / year

20173 Not applicable3 High2 Low1 not blocked3 No public exploit3 20181 Not applicable1 High1 not blocked1 No public exploit1 20192 Not applicable2 High2 not blocked2 No public exploit2 20200 20212 Outside Waratek scope2 High1 Low1 not blocked2 No public exploit2 20221 Not applicable1 High1 not blocked1 No public exploit1 20235 Outside Waratek scope2 Not applicable3 High3 Medium2 not blocked5 No public exploit5 20240 20250 20261 Not applicable1 High1 not blocked1 No public exploit1

2017201820192020202120222023202420252026

15 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.

CVE	Severity	Published▾	Status	Exploitation	Description
CVE-2026-35535	High	2026-04-03	Not applicable	No public exploit	In Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups call, during a privilege drop before running the mailer, is not a fatal error and can lead to privilege escalation.
CVE-2023-7090	High	2023-12-23	Not applicable	No public exploit	A flaw was found in sudo in the handling of ipa_hostname, where ipa_hostname from /etc/sssd/sssd.conf was not propagated in sudo. Therefore, it leads to privilege mismanagement vulnerability in applications, where client hosts retain privileges even after retracting them.
CVE-2023-42465	High	2023-12-22	Not applicable	No public exploit	Sudo before 1.9.15 might allow row hammer attacks (for authentication bypass or privilege escalation) because application logic sometimes is based on not equaling an error value (instead of equaling a success value), and because the values do not resist flips of a single bit.
CVE-2023-28487	Medium	2023-03-16	Outside Waratek scope	No public exploit	Sudo before 1.9.13 does not escape control characters in sudoreplay output.
CVE-2023-28486	Medium	2023-03-16	Outside Waratek scope	No public exploit	Sudo before 1.9.13 does not escape control characters in log messages.
CVE-2023-27320	High	2023-02-28	Not applicable	No public exploit	Sudo before 1.9.13p2 has a double free in the per-command chroot feature.
CVE-2022-43995	High	2022-11-02	Not applicable	No public exploit	Sudo 1.8.0 through 1.9.12, with the crypt() password backend, contains a plugins/sudoers/auth/passwd.c array-out-of-bounds error that can result in a heap-based buffer over-read. This can be triggered by arbitrary local users with access to Sudo by entering a password of seven characters or fewer. The impact could vary depending on the system libraries, compiler, and processor architecture.
CVE-2021-23240	High	2021-01-12	Outside Waratek scope	No public exploit	selinux_edit_copy_tfiles in sudoedit in Sudo before 1.9.5 allows a local unprivileged user to gain file ownership and escalate privileges by replacing a temporary file with a symlink to an arbitrary file target. This affects SELinux RBAC support in permissive mode. Machines without SELinux are not vulnerable.
CVE-2021-23239	Low	2021-01-12	Outside Waratek scope	No public exploit	The sudoedit personality of Sudo before 1.9.5 may allow a local unprivileged user to perform arbitrary directory-existence tests by winning a sudo_edit.c race condition in replacing a user-controlled directory by a symlink to an arbitrary path.
CVE-2019-18684	High	2019-11-04	Not applicable	No public exploit	Sudo through 1.8.29 allows local users to escalate to root if they have write access to file descriptor 3 of the sudo process. This occurs because of a race condition between determining a uid, and the setresuid and openat system calls. The attacker can write "ALL ALL=(ALL) NOPASSWD:ALL" to /proc/#####/fd/3 at a time when Sudo is prompting for a password. NOTE: This has been disputed due to the way Linux /proc works. It has been argued that writing to /proc/#####/fd/3 would only be viable if you had permission to write to /etc/sudoers. Even with write permission to /proc/#####/fd/3, it would not help you write to /etc/sudoers
CVE-2005-4890	High	2019-11-04	Not applicable	No public exploit	There is a possible tty hijacking in shadow 4.x before 4.1.5 and sudo 1.x before 1.7.4 via "su - user -c program". The user session can be escaped to the parent session by using the TIOCSTI ioctl to push characters into the input buffer to be read by the next process.
CVE-2016-7076	High	2018-05-29	Not applicable	No public exploit	sudo before version 1.8.18p1 is vulnerable to a bypass in the sudo noexec restriction if application run via sudo executed wordexp() C library function with a user supplied argument. A local user permitted to run such application via sudo with noexec restriction could possibly use this flaw to execute arbitrary commands with elevated privileges.
CVE-2015-8239	High	2017-10-10	Not applicable	No public exploit	The SHA-2 digest support in the sudoers plugin in sudo after 1.8.7 allows local users with write permissions to parts of the called command to replace them before it is executed.
CVE-2017-1000368	High	2017-06-05	Not applicable	No public exploit	Todd Miller's sudo version 1.8.20p1 and earlier is vulnerable to an input validation (embedded newlines) in the get_process_ttyname() function resulting in information disclosure and command execution.
CVE-2014-9680	Low	2017-04-24	Not applicable	No public exploit	sudo before 1.8.12 does not ensure that the TZ environment variable is associated with a zoneinfo file, which allows local users to open arbitrary files for read access (but not view file contents) by running a program within an sudo session, as demonstrated by interfering with terminal output, discarding kernel-log messages, or repositioning tape drives.

CVE

Severity

Published▾

Status

Exploitation

Description

CVE-2026-35535

High

2026-04-03

Not applicable

No public exploit

In Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups call, during a privilege drop before running the mailer, is not a fatal error and can lead to privilege escalation.

CVE-2023-7090

High

2023-12-23

Not applicable

No public exploit

A flaw was found in sudo in the handling of ipa_hostname, where ipa_hostname from /etc/sssd/sssd.conf was not propagated in sudo. Therefore, it leads to privilege mismanagement vulnerability in applications, where client hosts retain privileges even after retracting them.

CVE-2023-42465

High

2023-12-22

Not applicable

No public exploit

Sudo before 1.9.15 might allow row hammer attacks (for authentication bypass or privilege escalation) because application logic sometimes is based on not equaling an error value (instead of equaling a success value), and because the values do not resist flips of a single bit.

CVE-2023-28487

Medium

2023-03-16

Outside Waratek scope

No public exploit

Sudo before 1.9.13 does not escape control characters in sudoreplay output.

CVE-2023-28486

Medium

2023-03-16

Outside Waratek scope

No public exploit

Sudo before 1.9.13 does not escape control characters in log messages.

CVE-2023-27320

High

2023-02-28

Not applicable

No public exploit

Sudo before 1.9.13p2 has a double free in the per-command chroot feature.

CVE-2022-43995

High

2022-11-02

Not applicable

No public exploit

Sudo 1.8.0 through 1.9.12, with the crypt() password backend, contains a plugins/sudoers/auth/passwd.c array-out-of-bounds error that can result in a heap-based buffer over-read. This can be triggered by arbitrary local users with access to Sudo by entering a password of seven characters or fewer. The impact could vary depending on the system libraries, compiler, and processor architecture.

CVE-2021-23240

High

2021-01-12

Outside Waratek scope

No public exploit

selinux_edit_copy_tfiles in sudoedit in Sudo before 1.9.5 allows a local unprivileged user to gain file ownership and escalate privileges by replacing a temporary file with a symlink to an arbitrary file target. This affects SELinux RBAC support in permissive mode. Machines without SELinux are not vulnerable.

CVE-2021-23239

Low

2021-01-12

Outside Waratek scope

No public exploit

The sudoedit personality of Sudo before 1.9.5 may allow a local unprivileged user to perform arbitrary directory-existence tests by winning a sudo_edit.c race condition in replacing a user-controlled directory by a symlink to an arbitrary path.

CVE-2019-18684

High

2019-11-04

Not applicable

No public exploit

Sudo through 1.8.29 allows local users to escalate to root if they have write access to file descriptor 3 of the sudo process. This occurs because of a race condition between determining a uid, and the setresuid and openat system calls. The attacker can write "ALL ALL=(ALL) NOPASSWD:ALL" to /proc/#####/fd/3 at a time when Sudo is prompting for a password. NOTE: This has been disputed due to the way Linux /proc works. It has been argued that writing to /proc/#####/fd/3 would only be viable if you had permission to write to /etc/sudoers. Even with write permission to /proc/#####/fd/3, it would not help you write to /etc/sudoers

CVE-2005-4890

High

2019-11-04

Not applicable

No public exploit

There is a possible tty hijacking in shadow 4.x before 4.1.5 and sudo 1.x before 1.7.4 via "su - user -c program". The user session can be escaped to the parent session by using the TIOCSTI ioctl to push characters into the input buffer to be read by the next process.

CVE-2016-7076

High

2018-05-29

Not applicable

No public exploit

sudo before version 1.8.18p1 is vulnerable to a bypass in the sudo noexec restriction if application run via sudo executed wordexp() C library function with a user supplied argument. A local user permitted to run such application via sudo with noexec restriction could possibly use this flaw to execute arbitrary commands with elevated privileges.

CVE-2015-8239

High

2017-10-10

Not applicable

No public exploit

The SHA-2 digest support in the sudoers plugin in sudo after 1.8.7 allows local users with write permissions to parts of the called command to replace them before it is executed.

CVE-2017-1000368

High

2017-06-05

Not applicable

No public exploit

Todd Miller's sudo version 1.8.20p1 and earlier is vulnerable to an input validation (embedded newlines) in the get_process_ttyname() function resulting in information disclosure and command execution.

CVE-2014-9680

Low

2017-04-24

Not applicable

No public exploit

sudo before 1.8.12 does not ensure that the TZ environment variable is associated with a zoneinfo file, which allows local users to open arbitrary files for read access (but not view file contents) by running a program within an sudo session, as demonstrated by interfering with terminal output, discarding kernel-log messages, or repositioning tape drives.