CVE-2023-42465

HIGH

Sudo < 1.9.15 - Privilege Escalation

Title source: rule

Description

Sudo before 1.9.15 might allow row hammer attacks (for authentication bypass or privilege escalation) because application logic sometimes is based on not equaling an error value (instead of equaling a success value), and because the values do not resist flips of a single bit.

References (13)

Core 13

Core References

Technical Description, Third Party Advisory

https://arxiv.org/abs/2309.02545

Patch

https://github.com/sudo-project/sudo/commit/7873f8334c8d31031f8cfa83bd97ac6029309e4f

View Patch ZIP pw:eip

Release Notes

https://github.com/sudo-project/sudo/releases/tag/SUDO_1_9_15

Exploit, Mailing List

https://www.openwall.com/lists/oss-security/2023/12/21/9

Release Notes

https://www.sudo.ws/releases/changelog/

Vendor Advisory

https://security.netapp.com/advisory/ntap-20240208-0002/

Mailing List, Third Party Advisory

https://lists.fedoraproject.org/archives/list/[email protected]/message/R4Q23NHCKCLFIHSNY6KJ27GM7FSCEVXM/

Mailing List, Third Party Advisory

https://lists.fedoraproject.org/archives/list/[email protected]/message/U6XMRUJCPII4MPWG43HTYR76DGLEYEFZ/

Mailing List

http://www.openwall.com/lists/oss-security/2025/09/23/2

Mailing List

http://www.openwall.com/lists/oss-security/2025/09/24/6

Third Party Advisory vendor-advisory

https://security.gentoo.org/glsa/202401-29

Mailing List, Third Party Advisory vendor-advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U6XMRUJCPII4MPWG43HTYR76DGLEYEFZ/

Mailing List, Third Party Advisory vendor-advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R4Q23NHCKCLFIHSNY6KJ27GM7FSCEVXM/

Scores

CVSS v3 7.0

EPSS 0.0000

EPSS Percentile 0.1%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

Status published

Products (1)

sudo_project/sudo < 1.9.15

Published Dec 22, 2023

Tracked Since Feb 18, 2026