REDHAT-BUG-2539327: High severity Sudo Sudo vulnerability
A flaw was found in sudo's handling of NOTBEFORE and NOTAFTER time-based authorization in sudoers rules. The parsegentime() function in plugins/sudoers/gentime.c uses mktime() to interpret timestamps that lack a timezone suffix (no trailing 'Z' or explicit UTC offset). Because mktime() converts based on the process's TZ environment variable, and sudo is a setuid-root program that inherits the caller's environment, an unprivileged user can set TZ to an extreme POSIX timezone offset (e.g., TZ=XXX24) to shift the time evaluation window by up to ~25 hours in either direction. This allows expired NOTAFTER rules to appear valid, or not-yet-active NOTBEFORE rules to become usable. Authentication (PAM) is NOT bypassed; only the time-based authorization decision is affected.
The feature was introduced in sudo 1.8.20. All versions from 1.8.20 through 1.9.17p2 are affected. The fix was committed to upstream main by Todd Miller on 2026-08-29 (commit 1820a349687522f51023d1ae5925125f59679a8c) but sudo 1.9.18 has not been released.
Reported by Ermenson Junior (independent security researcher) on 2026-08-28. PSIRT Ticket: PSIRTSUPT-24357
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
sudoto a version that resolves this vulnerability.Patch 1820a349687522f51023d1ae5925125f59679a8c
Event History
Frequently Asked Questions
Which sudoers rules are affected?
Only NOTBEFORE or NOTAFTER timestamps that omit both a trailing Z and an explicit UTC offset are affected. Timestamps with an explicit timezone are not described as vulnerable to this issue.
What does an attacker need to exploit this?
The attacker must be an unprivileged local user able to invoke sudo and set its TZ environment variable to an extreme POSIX timezone offset. PAM authentication is still required; this issue changes only the time-based authorization decision.
How can I identify systems that may be exposed?
Check whether sudo is version 1.8.20 through 1.9.17p2 and inspect sudoers rules for NOTBEFORE or NOTAFTER values without a timezone suffix or UTC offset. Such rules may be made to appear active before their intended start time or after their expiration time.