Vulnerability · Published Feb 28, 2023 · Assigned by mitre
CVE-2023-27320
High 7.2
In plain English
A high-severity double free in the sudo package (Debian). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 77% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.2High
Exploit odds (30 days)1.7%top 23.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Sudo before 1.9.13p2 has a double free in the per-command chroot feature.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | sudo | 1.9.13p3-1 | DEBIAN-CVE-2023-27320 |
| Debian:13 | sudo | 1.9.13p3-1 | DEBIAN-CVE-2023-27320 |
| Debian:14 | sudo | 1.9.13p3-1 | DEBIAN-CVE-2023-27320 |
| Ubuntu:22.04:LTS | sudo | 1.9.9-1ubuntu2.3 | USN-5908-1 |
| Ubuntu:22.04:LTS | sudo | 1.9.9-1ubuntu2.3 | UBUNTU-CVE-2023-27320 |
Affected products (as reported)
Weakness: CWE-415 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
References
- https://www.openwall.com/lists/oss-security/2023/02/28/1
- https://www.sudo.ws/releases/stable/#1.9.13p2
- [oss-security] 20230301 Re: sudo: double free with per-command chroot sudoers rules mailing-list
- FEDORA-2023-d2d6ec2a32 vendor-advisory
- FEDORA-2023-11c9d868ca vendor-advisory
- FEDORA-2023-cb5df36beb vendor-advisory
- https://security.netapp.com/advisory/ntap-20230413-0009/
- GLSA-202309-12 vendor-advisory