Sudo before 1.9.15 might allow row hammer attacks (for authentication bypass or privilege escalation) because application logic sometimes is based on not equaling an error value (instead of equaling a success value), and because the values do not resist flips of a single bit.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Sudo | Sudo_project | * | 1.9.15 (excluding) |
| Red Hat Enterprise Linux 8 | RedHat | sudo-0:1.9.5p2-1.el8_9 | * |
| Red Hat Enterprise Linux 8.6 Extended Update Support | RedHat | sudo-0:1.9.5p2-1.el8_6 | * |
| Red Hat Enterprise Linux 8.8 Extended Update Support | RedHat | sudo-0:1.9.5p2-1.el8_8 | * |
| Red Hat Enterprise Linux 9 | RedHat | sudo-0:1.9.5p2-10.el9_3 | * |
| Red Hat Enterprise Linux 9 | RedHat | sudo-0:1.9.5p2-10.el9_3 | * |
| Red Hat Enterprise Linux 9.0 Extended Update Support | RedHat | sudo-0:1.9.5p2-7.el9_0.4 | * |
| Red Hat Enterprise Linux 9.2 Extended Update Support | RedHat | sudo-0:1.9.5p2-9.el9_2.2 | * |
| RHODF-4.15-RHEL-9 | RedHat | odf4/cephcsi-rhel9:v4.15.0-37 | * |
| RHODF-4.15-RHEL-9 | RedHat | odf4/mcg-core-rhel9:v4.15.0-68 | * |
| RHODF-4.15-RHEL-9 | RedHat | odf4/mcg-operator-bundle:v4.15.0-158 | * |
| RHODF-4.15-RHEL-9 | RedHat | odf4/mcg-rhel9-operator:v4.15.0-39 | * |
| RHODF-4.15-RHEL-9 | RedHat | odf4/ocs-client-console-rhel9:v4.15.0-58 | * |
| RHODF-4.15-RHEL-9 | RedHat | odf4/ocs-client-operator-bundle:v4.15.0-158 | * |
| RHODF-4.15-RHEL-9 | RedHat | odf4/ocs-client-rhel9-operator:v4.15.0-13 | * |
| RHODF-4.15-RHEL-9 | RedHat | odf4/ocs-metrics-exporter-rhel9:v4.15.0-81 | * |
| RHODF-4.15-RHEL-9 | RedHat | odf4/ocs-operator-bundle:v4.15.0-158 | * |
| RHODF-4.15-RHEL-9 | RedHat | odf4/ocs-rhel9-operator:v4.15.0-79 | * |
| RHODF-4.15-RHEL-9 | RedHat | odf4/odf-cli-rhel9:v4.15.0-22 | * |
| RHODF-4.15-RHEL-9 | RedHat | odf4/odf-console-rhel9:v4.15.0-57 | * |
| RHODF-4.15-RHEL-9 | RedHat | odf4/odf-cosi-sidecar-rhel9:v4.15.0-6 | * |
| RHODF-4.15-RHEL-9 | RedHat | odf4/odf-csi-addons-operator-bundle:v4.15.0-158 | * |
| RHODF-4.15-RHEL-9 | RedHat | odf4/odf-csi-addons-rhel9-operator:v4.15.0-15 | * |
| RHODF-4.15-RHEL-9 | RedHat | odf4/odf-csi-addons-sidecar-rhel9:v4.15.0-15 | * |
| RHODF-4.15-RHEL-9 | RedHat | odf4/odf-multicluster-console-rhel9:v4.15.0-54 | * |
| RHODF-4.15-RHEL-9 | RedHat | odf4/odf-multicluster-operator-bundle:v4.15.0-158 | * |
| RHODF-4.15-RHEL-9 | RedHat | odf4/odf-multicluster-rhel9-operator:v4.15.0-10 | * |
| RHODF-4.15-RHEL-9 | RedHat | odf4/odf-must-gather-rhel9:v4.15.0-26 | * |
| RHODF-4.15-RHEL-9 | RedHat | odf4/odf-operator-bundle:v4.15.0-158 | * |
| RHODF-4.15-RHEL-9 | RedHat | odf4/odf-rhel9-operator:v4.15.0-19 | * |
| RHODF-4.15-RHEL-9 | RedHat | odf4/odr-cluster-operator-bundle:v4.15.0-158 | * |
| RHODF-4.15-RHEL-9 | RedHat | odf4/odr-hub-operator-bundle:v4.15.0-158 | * |
| RHODF-4.15-RHEL-9 | RedHat | odf4/odr-rhel9-operator:v4.15.0-21 | * |
| RHODF-4.15-RHEL-9 | RedHat | odf4/rook-ceph-rhel9-operator:v4.15.0-103 | * |
| Sudo | Ubuntu | bionic | * |
| Sudo | Ubuntu | trusty | * |
| Sudo | Ubuntu | upstream | * |
| Sudo | Ubuntu | xenial | * |
References
- https://arxiv.org/abs/2309.02545
- https://github.com/sudo-project/sudo/commit/7873f8334c8d31031f8cfa83bd97ac6029309e4f
- https://github.com/sudo-project/sudo/releases/tag/SUDO_1_9_15
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R4Q23NHCKCLFIHSNY6KJ27GM7FSCEVXM/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U6XMRUJCPII4MPWG43HTYR76DGLEYEFZ/
- https://security.gentoo.org/glsa/202401-29
- https://security.netapp.com/advisory/ntap-20240208-0002/
- https://www.openwall.com/lists/oss-security/2023/12/21/9
- https://www.sudo.ws/releases/changelog/
- http://www.openwall.com/lists/oss-security/2025/09/23/2
- http://www.openwall.com/lists/oss-security/2025/09/24/6
- https://arxiv.org/abs/2309.02545
- https://github.com/sudo-project/sudo/commit/7873f8334c8d31031f8cfa83bd97ac6029309e4f
- https://github.com/sudo-project/sudo/releases/tag/SUDO_1_9_15
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R4Q23NHCKCLFIHSNY6KJ27GM7FSCEVXM/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U6XMRUJCPII4MPWG43HTYR76DGLEYEFZ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R4Q23NHCKCLFIHSNY6KJ27GM7FSCEVXM/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U6XMRUJCPII4MPWG43HTYR76DGLEYEFZ/
- https://security.gentoo.org/glsa/202401-29
- https://security.netapp.com/advisory/ntap-20240208-0002/
- https://www.openwall.com/lists/oss-security/2023/12/21/9
- https://www.sudo.ws/releases/changelog/