Skip to content
OpenAdvisories
Unscored USN-8708-2 0 CVEs

rust-sudo-rs vulnerability

Published Oct 20, 2026 · Updated Oct 20, 2026

Summary

USN-8708-1 fixed a vulnerability in sudo-rs. This update provides the
corresponding fix for Ubuntu 26.10.

Original advisory details:

It was discovered that sudo-rs incorrectly handled time-of-check vs time-
of-use conditions in sudoedit. A local attacker with permission to edit
specific files using sudoedit could use this issue to place files in
arbitrary directories, and possibly escalate their privileges. This issue
only affected systems configured to grant fine-grained sudoedit file
editing permissions, which is not the default configuration.

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 26.10 rust-sudo-rs 0.2.14-1ubuntu4.1

References

  • report
    https://bugs.launchpad.net/bugs/2165142