CVE-2015-8239

HIGH

sudo - Race Condition in SHA-2 Digest Handling

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2015-8239. PoCs published by justinsteven.

AI-analyzed exploit summary This repository contains a functional proof-of-concept exploit for CVE-2015-8239, demonstrating a TOCTOU (Time-of-Check to Time-of-Use) race condition in sudo's Digest_Spec feature. The exploit uses inotify to detect file access and replace the target binary during execution, bypassing hash verification.

Description

The SHA-2 digest support in the sudoers plugin in sudo after 1.8.7 allows local users with write permissions to parts of the called command to replace them before it is executed.

Exploits (1)

nomisec WORKING POC
by justinsteven · poc
https://github.com/justinsteven/sudo_digest_toctou_poc_CVE-2015-8239

This repository contains a functional proof-of-concept exploit for CVE-2015-8239, demonstrating a TOCTOU (Time-of-Check to Time-of-Use) race condition in sudo's Digest_Spec feature. The exploit uses inotify to detect file access and replace the target binary during execution, bypassing hash verification.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Moderate
Reliability
Racy
Target: sudo (versions with Digest_Spec feature)
Auth required
Prerequisites: Write access to the target binary · Ability to execute code as a non-root user · Digest_Spec configured in sudoers
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (5)

Core 5
Core References
Issue Tracking, Patch, Third Party Advisory x_refsource_confirm
https://www.sudo.ws/repos/sudo/rev/397722cdd7ec
Issue Tracking, Patch, Third Party Advisory x_refsource_confirm
https://www.sudo.ws/repos/sudo/rev/0cd3cc8fa195
Issue Tracking, Patch, Third Party Advisory x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=1283635
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2015/11/18/22
Issue Tracking, Patch, Third Party Advisory x_refsource_confirm
https://www.sudo.ws/repos/sudo/rev/24a3d9215c64

Scores

CVSS v3 7.0
EPSS 0.0054
EPSS Percentile 41.3%
Attack Vector LOCAL
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-362
Status published
Products (7)
sudo_project/sudo 1.8.8 (5 CPE variants)
sudo_project/sudo 1.8.9 (10 CPE variants)
sudo_project/sudo 1.8.10 (11 CPE variants)
sudo_project/sudo 1.8.11 (9 CPE variants)
sudo_project/sudo 1.8.12 (6 CPE variants)
sudo_project/sudo 1.8.13 (7 CPE variants)
sudo_project/sudo 1.8.14 (2 CPE variants)
Published Oct 10, 2017
Tracked Since Feb 18, 2026