Ubuntu 26.10 sudo-rs update fixes sudoedit race (USN-8708-2)
Original title: USN-8708-2: sudo-rs vulnerability
A local user allowed to sudoedit specific files could write files elsewhere and possibly gain higher privileges.
USN-8708-2 ships for Ubuntu 26.10 the sudo-rs fix already issued in USN-8708-1. Ubuntu says sudo-rs mishandled a time-of-check versus time-of-use condition in sudoedit, so a local user permitted to edit specific files could place files in arbitrary directories and possibly escalate privileges. Ubuntu says this applies only when fine-grained sudoedit file permissions are configured, which is not the default.
- The notice covers Ubuntu 26.10 and follows USN-8708-1.
- Default sudoedit configurations are not affected, according to Ubuntu.
- No CVE id or package version string appears in the snippet.
Impact: local file placement and possible privilege escalation via sudoedit
| Product | Affected |
|---|---|
| Ubuntu sudo-rs | Ubuntu 26.10 |
- 1.Install the Ubuntu 26.10 sudo-rs update from USN-8708-2.
- 2.Review hosts that grant fine-grained sudoedit file-editing permissions.
From the original article
USN-8708-1 fixed a vulnerability in sudo-rs. This update provides the corresponding fix for Ubuntu 26. 10.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.