PT-2023-1647 · Sudo+4 · Sudo+4

Published 2023-02-27 · Updated 2025-07-02 · CVE-2023-27320

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sudo versions prior to 1.9.13p2

Description The issue is related to a double free in the per-command chroot feature of the Sudo program. This can potentially allow an attacker to cause a denial of service.

Recommendations For versions prior to 1.9.13p2, update to version 1.9.13p2 or later to resolve the issue.

Exploit

Fix

Double Free

Weakness Enumeration

CWE-415

Related Identifiers

ALT-PU-2023-1357

ALT-PU-2023-1440

ALT-PU-2024-7909

AZL-13784

BDU:2023-01183

CVE-2023-27320

OESA-2023-1160

OESA-2023-1172

OPENSUSE-SU-2024:12795-1

SUSE-SU-2023:1665-1

SUSE-SU-2023_1665-1

USN-5908-1

Affected Products

Alt Linux

Linuxmint

Sudo

Suse

Ubuntu

References · 48

• 🔥 https://openwall.com/lists/oss-security/2023/02/28/1 · Exploit
• https://security.gentoo.org/glsa/202309-12 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-27320 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-27320 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5908-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FPLXMRAMXC3BYL4DNKVTK3V6JDMUXZ7B · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-27320 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2023-1160 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:12795-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5908-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-27320 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-27320 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-13784 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-27320 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/332KN4QI6QXB7NI7SWSJ2EQJKWIILFN6 · Vendor Advisory