A high-severity security flaw in Sudo allows authorized local users to bypass command execution policies and logging mechanisms by leveraging the execveat system call.

This vulnerability involves a protection mechanism failure within the Sudo ptrace-based intercept mode. Specifically, the software fails to correctly validate the execveat system call, allowing a low-privileged authenticated user to execute restricted programs directly or via fexecve while evading policy enforcement and audit logging.

The ability to bypass Sudo policies represents a significant breakdown in system security and accountability. An attacker can execute unauthorized commands without detection, potentially leading to privilege escalation, unauthorized system configuration changes, or the exfiltration of sensitive data. With a CVSS score of 7.8, this vulnerability poses a high risk to environment integrity and compliance requirements, as audit trails for privileged operations can no longer be considered reliable.

Immediate Action: Update the Sudo package to the latest version provided by your distribution vendor that includes the fix for this intercept policy bypass.

Proactive Monitoring: Review system audit logs for unusual process execution patterns, particularly those originating from users with restricted sudo capabilities, to identify potential exploitation attempts.

Compensating Controls: If immediate patching is not possible, consider disabling ptrace-based intercept mode in the Sudo configuration if it is not strictly required for your operational environment.

Public Exploit Available: Unknown

Given the potential for complete bypass of security controls and audit logging, this vulnerability should be treated with high priority. Organizations must ensure that their package management systems are configured to pull the latest security updates for Sudo and should verify that the patch is applied across all relevant Linux and Unix-based infrastructure to restore the integrity of the command execution policy.