Sudo before 1.9.15 might allow row hammer attacks (for authentication bypass or privilege escalation) because application logic sometimes i…

published 2023-12-22 2 y ago modified 2026-06-17 4 mo ago also EUVD-2023-46905

cvss: 7.0; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.6%; EPSS 0.6% chance of exploitation in 30 days, percentile 47%
public exploits: 0; none known

Sudo before 1.9.15 might allow row hammer attacks (for authentication bypass or privilege escalation) because application logic sometimes is based on not equaling an error value (instead of equaling a success value), and because the values do not resist flips of a single bit.

Patch / fix

fixed in 1 distros 6 links 2

sudo_project sudo 1.9.15

debian red hat suse opensuse almalinux azure linux

sudo Debian 14, Debian 13 1.9.15p2-2

debian advisories DEBIAN-CVE-2023-42465

sudo RHEL 8 1.9.5p2-1.el8_9
sudo RHEL 9 1.9.5p2-10.el9_3
sudo-python-plugin RHEL 9 1.9.5p2-10.el9_3
sudo RHEL 8.6 EUS 1.9.5p2-1.el8_6
sudo RHEL 8.8 EUS 1.9.5p2-1.el8_8
sudo RHEL 9.0 EUS 1.9.5p2-7.el9_0.4
sudo RHEL 9.2 EUS 1.9.5p2-9.el9_2.2
sudo-python-plugin RHEL 9.0 EUS 1.9.5p2-7.el9_0.4

red hat advisories RHSA-2024:0811

sudo SLES for SAP 12 SP5, SLES 12 SP5, SLE Software Development Kit 12 SP5 1.8.27-4.48.2
sudo SLES for SAP 15 SP4, SLES 15 SP4-LTSS, SLE Micro 5.4 +7 more 1.9.9-150400.4.36.1
sudo SLE Module for Basesystem 15 SP5, SLE Micro 5.5, openSUSE Leap 15.5 1.9.12p1-150500.7.10.1
sudo SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE Micro 5.2 +3 more 1.9.5p2-150300.3.33.1
sudo SLES for SAP 15 SP2, SLES 15 SP2-LTSS, SLE High Performance Computing 15 SP2-LTSS 1.8.27-150000.4.53.1

suse advisories SUSE-SU-2024:0890-1 SUSE-SU-2024:0889-1 SUSE-SU-2024:0877-1 SUSE-SU-2024:0876-2 SUSE-SU-2024:0876-1 SUSE-SU-2024:0834-1

sudo openSUSE Tumbleweed 1.9.15p2-1.1

opensuse advisories openSUSE-SU-2024:13490-1

sudo AlmaLinux 9 1.9.5p2-10.el9_3
sudo-python-plugin AlmaLinux 9 1.9.5p2-10.el9_3

almalinux advisories ALSA-2024:0811

sudo CBL-Mariner 2.0 1.9.15p5-1

azure linux advisories AZL-32227

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

github.com/sudo-project/sudo@7873f83 commit
github.com/sudo-project/sudo/releases/tag/SUDO_1_9_15 release

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-42465 updated 2026-11-07 cvss 7.0

sudo: Targeted Corruption of Register and Stack Variables

Red Hat Enterprise Linux 6 sudo Red Hat Enterprise Linux 7 sudo
affected: workaround, no fix planned “Out of support scope”
Red Hat Enterprise Linux AppStream (v. 9) sudo-python-plugin 1.9.5p2-10.el9_3 Red Hat Enterprise Linux AppStream EUS (v.9.0) sudo-python-plugin 1.9.5p2-7.el9_0.4 Red Hat Enterprise Linux AppStream EUS (v.9.2) sudo-python-plugin 1.9.5p2-9.el9_2.2 Red Hat Enterprise Linux BaseOS (v. 8) sudo 1.9.5p2-1.el8_9 Red Hat Enterprise Linux BaseOS (v. 9) sudo 1.9.5p2-10.el9_3 Red Hat Enterprise Linux BaseOS EUS (v.8.6) sudo 1.9.5p2-1.el8_6

+3 more productsfewer

Red Hat Enterprise Linux BaseOS EUS (v.8.8) sudo 1.9.5p2-1.el8_8 Red Hat Enterprise Linux BaseOS EUS (v.9.0) sudo 1.9.5p2-7.el9_0.4 Red Hat Enterprise Linux BaseOS EUS (v.9.2) sudo 1.9.5p2-9.el9_2.2

fixed: vendor fix RHSA-2024:0811
Red Hat RHODF 4.15 for RHEL 9 odf4/cephcsi-rhel9 v4.15.0-37, odf4/odf-cli-rhel9 v4.15.0-22, odf4/mcg-core-rhel9 v4.15.0-68, odf4/odf-console-rhel9 v4.15.0-57, odf4/mcg-rhel9-operator v4.15.0-39, odf4/ocs-rhel9-operator v4.15.0-79, +20 more
fixed: vendor fix RHSA-2024:1383

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.57% chance of exploitation in the next 30 days, higher than 47% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

openwall.com https://www.openwall.com/lists/oss-security/2023/12/21/9 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	3.1	7.0	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

References

github.com /sudo-project/sudo/commit/7873f8334c8d31031f8cfa83bd97ac6029309e4f
patch
openwall.com /lists/oss-security/2023/12/21/9
exploit, mailing-list
security.gentoo.org /glsa/202401-29
vendor-advisory
lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/U6XMRUJCPII4MPWG43HTYR76DGLEYEFZ/
vendor-advisory
lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/R4Q23NHCKCLFIHSNY6KJ27GM7FSCEVXM/
vendor-advisory
sudo.ws /releases/changelog/
release-notes
arxiv.org /abs/2309.02545
technical-description, third-party-advisory
github.com /sudo-project/sudo/releases/tag/SUDO_1_9_15
release-notes
security.netapp.com /advisory/ntap-20240208-0002/
lists.fedoraproject.org /archives/list/package-announce@lists.fedoraproject.org/message/R4Q23NHCKCLFIHSNY6KJ27GM7FSCEVXM/
lists.fedoraproject.org /archives/list/package-announce@lists.fedoraproject.org/message/U6XMRUJCPII4MPWG43HTYR76DGLEYEFZ/
openwall.com /lists/oss-security/2025/09/23/2
openwall.com /lists/oss-security/2025/09/24/6

Sources

CVE List CVE-2023-42465
NVD CVE-2023-42465

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary