Description

Sudo through 1.9.17p2 fails to apply intercept policy checks to the execveat system call in ptrace-based intercept mode. Users permitted to run specific commands can execute denied programs by calling execveat directly or through fexecve, bypassing policy enforcement and logging.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-29T17:17:59.910Z",
  "pubdate": "2026-08-29T17:17:59.910Z",
  "executiveSummary": "This vulnerability is an improper access control flaw within the Sudo policy enforcement mechanism, specifically affecting systems using ptrace-based intercept mode.\nThe vulnerability allows an authorized Sudo user to bypass security policy restrictions and audit logging requirements.\nBy invoking the execveat system call or utilizing fexecve, an attacker can execute unauthorized programs that are otherwise restricted by the Sudo policy configuration.\nThe flaw affects Sudo versions up to and including 1.9.17p2.\nThe primary risk involves unauthorized command execution and the evasion of security monitoring, which undermines the integrity of privileged command auditing.\nExploitation requires the attacker to already have been granted Sudo privileges for specific commands, which they subsequently abuse to escalate their execution capability beyond the intended policy scope.\nThis issue represents a significant failure in the syscall interception layer, which is responsible for ensuring that all executed binaries conform to the predefined security policy.",
  "technicalDetails": "The root cause of this vulnerability lies in the insufficient coverage of the Sudo ptrace-based intercept mode, which fails to mediate the execveat system call.\nSudo utilizes ptrace to monitor and intercept syscalls to enforce security policies and log administrative actions. While traditional execve calls are correctly mediated, the implementation fails to account for the execveat system call, which is a modern alternative for executing programs via file descriptors.\nAttack flow: An attacker who has been granted permission to execute specific binaries via Sudo can manipulate the execution flow by invoking execveat or calling fexecve, which internally utilizes execveat. Because the interceptor logic does not recognize execveat as a restricted event, the syscall is permitted to proceed to the kernel without validation against the policy engine.\nBy bypassing the policy engine, the attacker effectively circumvents the list of permitted or denied commands. Furthermore, because the mediation layer is skipped, the execution is not recorded in the Sudo audit logs, facilitating stealthy malicious activity.\nThis vulnerability is localized to the Sudo binary and its library components that manage syscall interception. Affected versions include all releases up to 1.9.17p2.\nExploitation does not require network exposure, as it is a local privilege elevation and policy evasion technique. The attacker must possess an existing, valid Sudo configuration that allows them to initiate a Sudo session, though the scope of that session is theoretically restricted by the policy. By utilizing this flaw, the attacker escapes the constraints placed upon their execution environment, effectively upgrading their access to unrestricted program execution within the context of the Sudo-invoked shell or process.\nThe payload behavior is characterized by the direct execution of unauthorized binaries. Since the policy check is never triggered, the system does not enter its blocking state, and the kernel proceeds with the execveat operation as if it were a standard, non-Sudo-governed process initiation. The impact includes the execution of arbitrary commands, evasion of forensic trails, and potential persistence if the user can execute arbitrary scripts or binaries with the privileges afforded to their Sudo entry."
}