Description
Todd Miller's sudo version 1.8.20 and earlier is vulnerable to an input validation (embedded spaces) in the get_process_ttyname() function resulting in information disclosure and command execution.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | sudo | 1.8.20p1-1 | — |
| Debian 13 | sudo | 1.8.20p1-1 | — |
| Debian 12 | sudo | 1.8.20p1-1 | — |
| Debian 8 | sudo | 1.8.10p3-1+deb8u4 | DSA-3867-1 |
| Debian 7 | sudo | 1.8.5p2-1+nmu3+deb7u3 | DLA-970-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | sudo | 1.8.16-0ubuntu1.4 | USN-3304-1 |
| Ubuntu 14.04 LTS | sudo | 1.8.9p5-1ubuntu1.4 | USN-3304-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | sudo +1 | 1.8.6p7-22.el7_3 | RHSA-2017:1382 |
| RHEL 6 | sudo +1 | 1.8.6p3-28.el6_9 | RHSA-2017:1382 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 ELS | sudo | 1.7.2p1-30.el5_11 | RHSA-2017:1381 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP2 | sudo | 1.8.10p3-10.5.1 | SUSE-SU-2017:1450-1 |
| SLES 12 SP1 | sudo | 1.8.10p3-2.11.1 | SUSE-SU-2017:1446-1 |
| SLES 12 | sudo | 1.8.10p3-2.11.1 | SUSE-SU-2017:1446-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP2 | sudo | 1.8.10p3-10.5.1 | SUSE-SU-2017:1450-1 |
| SLES for SAP 12 SP1 | sudo | 1.8.10p3-2.11.1 | SUSE-SU-2017:1446-1 |
| SLES for SAP 12 | sudo | 1.8.10p3-2.11.1 | SUSE-SU-2017:1446-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | sudo | 1.9.7p2-1.4 | openSUSE-SU-2024:11413-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | sudo +1 | 1.8.23-4.amzn2.0.1 | ALAS2-2019-1315 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | sudo +1 | 1.8.6p7-22.el7_3 | ELSA-2017-1382 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Sudo 1.8.20 - 'get_process_ttyname()' Local Privilege Escalation EDB-42183 · local · Jun 14, 2017
GitHub 4 repositories
-
c0d3z3r0/sudo-CVE-2017-1000367 ★ 114 · May 30, 2017
-
pucerpocok/sudo_exploit ★ 6 · Jun 8, 2017
own implementation of the CVE-2017-1000367 sudo privilege escalation vulnerability in python
-
homjxi0e/CVE-2017-1000367 ★ 1 · Jun 4, 2017
-
letsr00t/CVE-2017-1000367 ★ 0 · Oct 17, 2025
CVE-2017-1000367
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 10
- RHSA-2017:1382 Red Hat Security Advisory: sudo security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2017:1381 Red Hat Security Advisory: sudo security update Red Hat Security Advisories (RHSA) · May 13, 2026
- DLA-970-1 sudo - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-3867-1 sudo - security update Debian Security (DSA / DLA) · Mar 9, 2026
- USN-3304-1 sudo vulnerability Ubuntu Security Notices (USN) · Feb 10, 2026
- SUSE-SU-2017:1450-1 Security update for sudo SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11413-1 sudo-1.9.7p2-1.4 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2017:1446-1 Security update for sudo SUSE / openSUSE Security Updates · Feb 4, 2026
- ALAS2-2019-1315 Important: sudo security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Oct 14, 2019
- ELSA-2017-1382 Important: sudo security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · May 30, 2017
References
- USN-3304-1 vendor-advisory
- GLSA-201705-15 vendor-advisory
- 98745 vdb-entry
- https://www.sudo.ws/alerts/linux_tty.html
- 20170602 Qualys Security Advisory - CVE-2017-1000367 in Sudo's get_process_ttyname() for Linux mailing-list
- FEDORA-2017-54580efa82 vendor-advisory
- RHSA-2017:1382 vendor-advisory
- http://packetstormsecurity.com/files/142783/Sudo-get_process_ttyname-Race-Condition.html
- SUSE-SU-2017:1446 vendor-advisory
- SUSE-SU-2017:1450 vendor-advisory
- DSA-3867 vendor-advisory
- openSUSE-SU-2017:1455 vendor-advisory
- 42183 exploit
- [oss-security] 20170530 Qualys Security Advisory - CVE-2017-1000367 in Sudo's get_process_ttyname() for Linux mailing-list
- RHSA-2017:1381 vendor-advisory
- 1038582 vdb-entry
- [oss-security] 20221222 Re: [Linux] /proc/pid/stat parsing bugs mailing-list
- [oss-security] 20221222 Re: [Linux] /proc/pid/stat parsing bugs mailing-list