Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #1307004 > unrolled thread

Bug#1146136: sudo: CVE-2026-82474

Back to article view | Back to linux.debian.bugs.dist

Contents

  Bug#1146136: sudo: CVE-2026-82474 Salvatore Bonaccorso <carnil@debian.org> - 2026-08-30 11:00 +0200
    Bug#1146136: sudo: CVE-2026-82474 Marc Haber <mh+debian-packages@zugschlus.de> - 2026-08-31 19:50 +0200
      Bug#1146136: sudo: CVE-2026-82474 Salvatore Bonaccorso <carnil@debian.org> - 2026-08-31 21:20 +0200

#1307004 — Bug#1146136: sudo: CVE-2026-82474

Source: sudo
Version: 1.9.17p2-7
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>

Hi,

The following vulnerability was published for sudo.

CVE-2026-82474[0]:
| Sudo through 1.9.17p2 fails to apply intercept policy checks to the
| execveat system call in ptrace-based intercept mode. Users permitted
| to run specific commands can execute denied programs by calling
| execveat directly or through fexecve, bypassing policy enforcement
| and logging.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-82474
    https://www.cve.org/CVERecord?id=CVE-2026-82474
[1] https://github.com/sudo-project/sudo/commit/71fbe42dcd5a1c8f799540583a2dfb2ae6221edf

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

[toc] | [next] | [standalone]

#1307304

Control: tags -1 security upstream wontfix
thanks

On Sun, Aug 30, 2026 at 10:53:06AM +0200, Salvatore Bonaccorso wrote:
> The following vulnerability was published for sudo.
> 
> CVE-2026-82474[0]:
> | Sudo through 1.9.17p2 fails to apply intercept policy checks to the
> | execveat system call in ptrace-based intercept mode. Users permitted
> | to run specific commands can execute denied programs by calling
> | execveat directly or through fexecve, bypassing policy enforcement
> | and logging.
> 
> 
> If you fix the vulnerability please also make sure to include the
> CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

We talked about this offline and decided neither to do a DSA nor to pull 
the upstream fix for forky.

Tagging this wontfix, will close it with the next upstream release.

Greetings
Marc

[toc] | [prev] | [next] | [standalone]

#1307322

Hi Marc,

On Mon, Aug 31, 2026 at 07:38:35PM +0200, Marc Haber wrote:
> Control: tags -1 security upstream wontfix
> thanks
> 
> On Sun, Aug 30, 2026 at 10:53:06AM +0200, Salvatore Bonaccorso wrote:
> > The following vulnerability was published for sudo.
> > 
> > CVE-2026-82474[0]:
> > | Sudo through 1.9.17p2 fails to apply intercept policy checks to the
> > | execveat system call in ptrace-based intercept mode. Users permitted
> > | to run specific commands can execute denied programs by calling
> > | execveat directly or through fexecve, bypassing policy enforcement
> > | and logging.
> > 
> > 
> > If you fix the vulnerability please also make sure to include the
> > CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
> 
> We talked about this offline and decided neither to do a DSA nor to pull 
> the upstream fix for forky.
> 
> Tagging this wontfix, will close it with the next upstream release.

I have marked the issue as unimportant in the security-tracker and
once a new upstream version includes the fix and this bug is closed we
will simply update the unstable version tracking along.

Regards,
Salvatore

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.bugs.dist

csiph-web