Description
check.c in sudo 1.7.x before 1.7.4p5, when a Runas group is configured, does not require a password for command execution that involves a gid change but no uid change, which allows local users to bypass an intended authentication requirement via the -g option to a sudo command.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | sudo | 1.7.4p4-6 | — |
| Debian 13 | sudo | 1.7.4p4-6 | — |
| Debian 12 | sudo | 1.7.4p4-6 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | sudo | 1.7.4p5-5.el6 | RHSA-2011:0599 |
| RHEL 5 | sudo | 1.7.2p1-13.el5 | RHSA-2012:0309 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | sudo | 1.8.18p1-1.1 | openSUSE-SU-2024:10551-1 |
Advisories 3
- RHSA-2012:0309 Red Hat Security Advisory: sudo security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2011:0599 Red Hat Security Advisory: sudo security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- openSUSE-SU-2024:10551-1 sudo-1.8.18p1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- ADV-2011-0362 vdb-entry
- http://www.sudo.ws/sudo/alerts/runas_group_pw.html
- 43068 third-party-advisory
- GLSA-201203-06 vendor-advisory
- SSA:2011-041-05 vendor-advisory
- MDVSA-2011:018 vendor-advisory
- http://www.sudo.ws/repos/sudo/rev/07d1b0ce530e
- ADV-2011-0089 vdb-entry
- ADV-2011-0212 vdb-entry
- 42949 third-party-advisory
- [oss-security] 20110111 CVE request: sudo does not ask for password on GID changes mailing-list
- ADV-2011-0182 vdb-entry
- FEDORA-2011-0470 vendor-advisory
- ADV-2011-0199 vdb-entry
- USN-1046-1 vendor-advisory
- RHSA-2011:0599 vendor-advisory
- [oss-security] 20110112 Re: CVE request: sudo does not ask for password on GID changes mailing-list
- 70400 vdb-entry
- 42886 third-party-advisory
- SUSE-SR:2011:002 vendor-advisory
- sudo-groupid-privilege-escalation(64636) vdb-entry
- 45774 vdb-entry
- [oss-security] 20110112 Re: CVE request: sudo does not ask for password on GID changes mailing-list
- 43282 third-party-advisory
- FEDORA-2011-0455 vendor-advisory
- http://www.sudo.ws/repos/sudo/rev/fe8a94f96542
- ADV-2011-0195 vdb-entry
- https://bugzilla.redhat.com/show_bug.cgi?id=668879
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=609641
- 42968 third-party-advisory