AI analysis
A flaw in sudo causes time-based authorization checks (NOTBEFORE and NOTAFTER sudoers directives) to be evaluated using the caller's TZ environment variable whenever the rule's timestamp omits the trailing 'Z' UTC indicator. Because sudo runs setuid-root, any local unprivileged user who is permitted to run a command under such a rule can set TZ to an extreme timezone offset and shift the authorization window by up to roughly 25 hours, allowing expired rules to be treated as still valid (or not-yet-valid rules to fire early). The attacker gains the ability to execute allowed commands outside the intended time window, but authentication is not bypassed and only the time-based check is affected. Hosts are only exposed if their sudoers policy actually uses NOTBEFORE/NOTAFTER entries written without a trailing 'Z', which is an uncommon configuration, though the attacker also needs a valid local account with sudo-derived privileges. The flaw was assigned by Red Hat; no public proof of concept exists and it is not listed in CISA's Known Exploited Vulnerabilities catalog.
What to do: Audit all sudoers files (including #include'd fragments) for NOTBEFORE and NOTAFTER entries and append a trailing 'Z' (UTC) to every timestamp so evaluation no longer depends on the caller's TZ variable. Also check whether TZ appears in env_keep or is otherwise passed through, and remove it if policy does not require it. Apply vendor updates for sudo as patched packages become available, since no version fix is identified in the current advisory data.
Affected
| Sudo project (Todd M. Miller) sudo | — |
Estimated exposure
nicheunknown — plausibly thousands to tens of thousands of hosts at most, versus hundreds of millions of sudo installations overall — sudo ships on virtually every Linux/UNIX system, but exploitation requires sudoers rules that actually use NOTBEFORE/NOTAFTER with non-'Z' timestamps, a rarely deployed feature, so the truly vulnerable subset is small and no public count…
Description
A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone indicator, the time evaluation relies on the TZ environment variable inherited from the calling user. Because sudo is a setuid-root program, an unprivileged local user can set TZ to an extreme timezone offset to shift the authorization window by up to approximately 25 hours, causing expired rules to be treated as valid. This allows the user to execute commands outside the intended time window. Authentication is not bypassed; only the time-based authorization check is affected.