Sudo Policy Bypass via execveat System Call

Sudo versions up to and including 1.9.17p2 contain a security vulnerability (CVE-2026-82474) in the ptrace-based intercept mode. This feature, designed to enforce fine-grained policy restrictions on commands, fails to apply those policy checks to the execveat system call. Consequently, a user who is granted sudo privileges for specific commands can bypass these restrictions to execute arbitrary programs that were intended to be blocked. The vulnerability is triggered by directly invoking execveat or the fexecve function. This flaw undermines the security integrity of sudo-restricted environments, as it allows attackers to execute denied programs while simultaneously bypassing audit logging mechanisms associated with policy enforcement. This vulnerability is highly relevant to organizations relying on sudo intercept mode for privilege limitation and command auditing.

Impact

Successful exploitation allows local users to escalate their privileges by executing unauthorized commands that would otherwise be blocked by sudo policies. This impacts security posture by enabling lateral movement, persistence, or unauthorized system changes within the context of the elevated sudo session. Given the widespread use of sudo across Linux-based infrastructure, the potential for unauthorized code execution in restricted environments is high.

Recommendation

• Upgrade the Sudo package to version 1.9.17p3 or later to remediate CVE-2026-82474.
• Audit existing sudoers configurations to identify environments where ptrace-based intercept mode is enabled.
• Monitor system audit logs for anomalous execveat system call activity originating from users with restricted sudo access.