CVE-2017-1000367
published 2017-06-05CVE-2017-1000367: Todd Miller's sudo version 1.8.20 and earlier is vulnerable to an input validation (embedded spaces) in the get_process_ttyname() function resulting in…
PriorityP275medium6.4CVSS 3.0
AVLACHPRHUINSUCHIHAH
ITWEXPLOITVulnCheck KEVInitial access
Exploited in the wild
EPSS
8.02%
94.1th percentile
Todd Miller's sudo version 1.8.20 and earlier is vulnerable to an input validation (embedded spaces) in the get_process_ttyname() function resulting in information disclosure and command execution.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | sudo | < sudo 1.8.20p1-1 (bookworm) | sudo 1.8.20p1-1 (bookworm) |
| sudo_project | sudo | <= 1.8.20 | — |
| sudo_project | sudo | >= 0 < 1.8.20p1-1 | 1.8.20p1-1 |
| sudo_project | sudo | >= 0 < 1.8.20p1-1 | 1.8.20p1-1 |
| sudo_project | sudo | >= 0 < 1.8.20p1-1 | 1.8.20p1-1 |
| sudo_project | sudo | >= 0 < 1.8.20p1-1 | 1.8.20p1-1 |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor for creation of the working directory /dev/shm/_tmp and symlink /dev/shm/_tmp/_tty, which are hardcoded artifacts of the CVE-2017-1000367 exploit. ↗
- →Detect rapid creation and renaming of symlinks under /dev/shm targeting /dev/pts/* devices, indicative of the TTY symlink race condition exploitation technique used in this CVE. ↗
- →Monitor /proc/<pid>/stat reads by sudo combined with embedded spaces in the tty field, as the vulnerability is triggered by input validation failure in get_process_ttyname() parsing of /proc status files. ↗
- →Detect sudo invocations with an SELinux role argument (e.g., unconfined_r) from non-privileged users, as the exploit requires sudo to be run with a role to trigger the vulnerable code path. ↗
- →Detect mass opening of /dev/pts/* pseudo-terminal devices (up to 64 fds, PTS_NUM=32 pairs) by a single non-root process, which is used to predict and control the tty device number during exploitation. ↗
- ·The exploit targets sudo version 1.8.20 and earlier; systems running sudo 1.8.20p1-1 or later (as fixed in Debian) are not vulnerable to CVE-2017-1000367, though CVE-2017-1000368 covers an incomplete fix in 1.8.20p1 and earlier. ↗
- ·The exploit is only effective on Linux systems with SELinux enabled; the privilege escalation path requires the ability to pass a role argument to sudo. ↗
- ·When combined with the Stack Clash (CVE-2017-1000364), any local user (not just sudoers) can exploit sudo to obtain full root privileges, broadening the affected population beyond SELinux-only scenarios. ↗
- ·The RLIMIT_STACK/RLIMIT_AS workaround is unreliable; the Sudo stack-clash exploit variant may allocate as little as 137MB of heap memory and nearly no stack memory, potentially bypassing low resource limits. ↗
CVSS provenance
nvdv3.06.4MEDIUMCVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.9MEDIUMAV:L/AC:M/Au:N/C:C/I:C/A:C
osv6.4MEDIUM
vulncheck6.4MEDIUM
vendor_debian6.4MEDIUM
vendor_redhat6.4MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-4c2x-g299-mpv8: Todd Miller's sudo version 1
ghsa_unreviewed·2022-05-13
CVE-2017-1000367 [MEDIUM] CWE-362 GHSA-4c2x-g299-mpv8: Todd Miller's sudo version 1
Todd Miller's sudo version 1.8.20 and earlier is vulnerable to an input validation (embedded spaces) in the get_process_ttyname() function resulting in information disclosure and command execution.
OSV
CVE-2017-1000367: Todd Miller's sudo version 1
osv·2017-06-05·CVSS 6.4
CVE-2017-1000367 [MEDIUM] CVE-2017-1000367: Todd Miller's sudo version 1
Todd Miller's sudo version 1.8.20 and earlier is vulnerable to an input validation (embedded spaces) in the get_process_ttyname() function resulting in information disclosure and command execution.
VulnCheck
Sudo Sudo Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
vulncheck·2017·CVSS 6.4
CVE-2017-1000367 [MEDIUM] Sudo Sudo Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Sudo Sudo Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Todd Miller's sudo version 1.8.20 and earlier is vulnerable to an input validation (embedded spaces) in the get_process_ttyname() function resulting in information disclosure and command execution.
Affected: Sudo Sudo
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://information.rapid7.com/rs/411-NAK-970/images/Rapid7-2023-Mid-Year-Threat-Review.pdf
Exploit PoC: https://vulncheck.com/xdb/7a3c3c058b00; https://vulncheck.com/xdb/9b54c463f445; https://vulncheck.com/xdb/06af8fdfd7cc; https://vulncheck.com/xdb/16ac85b60c1f; https://vulncheck.com/xdb/d77
Red Hat
sudo: Privilege escalation via improper get_process_ttyname() parsing (insufficient fix for CVE-2017-1000367)
vendor_redhat·2017-06-02·CVSS 6.4
CVE-2017-1000368 [MEDIUM] CWE-20 sudo: Privilege escalation via improper get_process_ttyname() parsing (insufficient fix for CVE-2017-1000367)
sudo: Privilege escalation via improper get_process_ttyname() parsing (insufficient fix for CVE-2017-1000367)
Todd Miller's sudo version 1.8.20p1 and earlier is vulnerable to an input validation (embedded newlines) in the get_process_ttyname() function resulting in information disclosure and command execution.
It was found that the original fix for CVE-2017-1000367 was incomplete. A flaw was found in the way sudo parsed tty information from the process status file in the proc filesystem. A local user with privileges to execute commands via sudo could use this flaw to escalate their privileges to root.
Ubuntu
Sudo vulnerability
vendor_ubuntu·2017-05-30
CVE-2017-1000367 Sudo vulnerability
Title: Sudo vulnerability
Summary: Sudo could be made to overwrite files as the administrator.
It was discovered that Sudo did not properly parse the contents of
/proc/[pid]/stat when attempting to determine its controlling tty.
A local attacker in some configurations could possibly use this to
overwrite any file on the filesystem, bypassing intended permissions.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
sudo: Privilege escalation in via improper get_process_ttyname() parsing
vendor_redhat·2017-05-30·CVSS 6.4
CVE-2017-1000367 [MEDIUM] CWE-807 sudo: Privilege escalation in via improper get_process_ttyname() parsing
sudo: Privilege escalation in via improper get_process_ttyname() parsing
Todd Miller's sudo version 1.8.20 and earlier is vulnerable to an input validation (embedded spaces) in the get_process_ttyname() function resulting in information disclosure and command execution.
A flaw was found in the way sudo parsed tty information from the process status file in the proc filesystem. A local user with privileges to execute commands via sudo could use this flaw to escalate their privileges to root.
Debian
CVE-2017-1000367: sudo - Todd Miller's sudo version 1.8.20 and earlier is vulnerable to an input validati...
vendor_debian·2017·CVSS 6.4
CVE-2017-1000367 [MEDIUM] CVE-2017-1000367: sudo - Todd Miller's sudo version 1.8.20 and earlier is vulnerable to an input validati...
Todd Miller's sudo version 1.8.20 and earlier is vulnerable to an input validation (embedded spaces) in the get_process_ttyname() function resulting in information disclosure and command execution.
Scope: local
bookworm: resolved (fixed in 1.8.20p1-1)
bullseye: resolved (fixed in 1.8.20p1-1)
forky: resolved (fixed in 1.8.20p1-1)
sid: resolved (fixed in 1.8.20p1-1)
trixie: resolved (fixed in 1.8.20p1-1)
No detection rules found.
Qualys
The Stack Clash | Qualys
blogs_qualys·2017-06-19
The Stack Clash | Qualys
#### Table of Contents
- What is the Stack Clash?
- What is the Stack Clash vulnerability, precisely?
- Why is it called the Stack Clash?
- Is it a new vulnerability?
- Is the Stack Clash one or several vulnerabilities?
- Am I affected by the Stack Clash?
- What are the risks posed by the Stack Clash?
- Is it exploitable remotely?
- How can I protect my system from the Stack Clash?
- What if I cant (or dont want to) update or reboot my system?
- Where can I find the Stack Clash exploits?
- Where can I get more information?
- I want to write my own Stack Clash exploit, where do I start?
- Is the Sudo vulnerability Qualys published on May 30 related to Stack Clash?
## What is the Stack Clash?
The Stack Clash is a vulnerability in the memory management of several operating systems. It affe
Qualys
The Stack Clash
blogs_qualys·2017-06-19
The Stack Clash
## Table of Contents
What is the Stack Clash?
What is the Stack Clash vulnerability, precisely?
Why is it called the Stack Clash?
Is it a new vulnerability?
Is the Stack Clash one or several vulnerabilities?
Am I affected by the Stack Clash?
What are the risks posed by the Stack Clash?
Is it exploitable remotely?
How can I protect my system from the Stack Clash?
What if I cant (or dont want to) update or reboot my system?
Where can I find the Stack Clash exploits?
Where can I get more information?
I want to write my own Stack Clash exploit, where do I start?
Is the Sudo vulnerability Qualys published on May 30 related to Stack Clash?
## What is the Stack Clash?
The Stack Clash is a vulnerability in the memory management of several operating systems. It affects Linux, OpenBS
Checkpoint
2017-6-5 Global Cyber Attack Reports
blogs_checkpoint·2017-06-05
CVE-2017-1000367 2017-6-5 Global Cyber Attack Reports
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 2017-6-5 Global Cyber Attack Reports
TOP ATTACKS AND BREACHES
A new publication written by Check Point researchers describes Fireball, a malware targeting web browsers and hijacking them for monetizing purposes. The malware, which is estimated to have infected over 250 million devices and over 20% of all networks worldwide, conducts changes in the browser such as changing the default homepage and search engine, and other browser content and DNS manipulations. Fireball is estimated to be used for advertising purp
Recorded Future
The Race Between Security Professionals and Adversaries
blogs_recorded_future
The Race Between Security Professionals and Adversaries
# The Race Between Security Professionals and Adversaries
We examined vulnerabilities between first disclosure and release on the National Vulnerability Database (NVD) to understand timelines of the security community and threat actors.
### Key Takeaways
- 75% of vulnerabilities are disclosed prior to NVD release with a median of seven days prior notice. This median gap is increasing, complicating the ability of vulnerability management teams to stay current and, with increasing gaps, the situation is worsening.
- Over 1,500 sources reported over 114,000 times on vulnerabilities prior to release, including community intelligence and adversary intelligence sources on the deep and dark web.
- Higher severity vulnerabilities have shorter release lags as more effort is put into communicatin
Bugzilla
CVE-2017-1000368 sudo: Privilege escalation via improper get_process_ttyname() parsing (insufficient fix for CVE-2017-1000367)
bugzilla·2017-06-06·CVSS 6.4
CVE-2017-1000368 [MEDIUM] CVE-2017-1000368 sudo: Privilege escalation via improper get_process_ttyname() parsing (insufficient fix for CVE-2017-1000367)
CVE-2017-1000368 sudo: Privilege escalation via improper get_process_ttyname() parsing (insufficient fix for CVE-2017-1000367)
Todd Miller's sudo version 1.8.20p1 and earlier is vulnerable to an input validation (embedded newlines) in the get_process_ttyname() function resulting in information disclosure and command execution.
Discussion:
External References:
https://www.sudo.ws/alerts/linux_tty.html
https://access.redhat.com/security/vulnerabilities/3059071
https://access.redhat.com/security/cve/CVE-2017-1000367
---
*** Bug 1458425 has been marked as a duplicate of this bug. ***
---
Upstream patch seems to be:
https://www.sudo.ws/repos/sudo/rev/15a46f4007dd
---
Notes about exploitation:
This flaw can lead to executing commands as root, when a root terminal is open on the same
Bugzilla
CVE-2017-1000367 sudo: sudo: Privilege escalation in via improper get_process_ttyname() parsing [fedora-all]
bugzilla·2017-05-30·CVSS 6.4
CVE-2017-1000367 [MEDIUM] CVE-2017-1000367 sudo: sudo: Privilege escalation in via improper get_process_ttyname() parsing [fedora-all]
CVE-2017-1000367 sudo: sudo: Privilege escalation in via improper get_process_ttyname() parsing [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affe
Bugzilla
CVE-2017-1000367 sudo: Privilege escalation in via improper get_process_ttyname() parsing
bugzilla·2017-05-22·CVSS 6.4
CVE-2017-1000367 [MEDIUM] CVE-2017-1000367 sudo: Privilege escalation in via improper get_process_ttyname() parsing
CVE-2017-1000367 sudo: Privilege escalation in via improper get_process_ttyname() parsing
A flaw was found in the way sudo read the device number of the tty from field 7 (tty_nr) from "/proc/[pid]/stat". A local attacker could use this flaw to escalate his privilege to root.
Discussion:
Acknowledgments:
Name: Qualys Security
---
Created attachment 1282109
sudo patch
---
Created attachment 1282148
proposed rhel-7.3.z patch
---
Created attachment 1282158
Isolated reproducer with commented out old code (copied code from sudo-1.8.6)
The same patch applies to rhel-6.10 and rhel-6.9.
---
Created sudo tracking bugs for this issue:
Affects: fedora-all [bug 1456884]
---
External References:
https://www.sudo.ws/alerts/linux_tty.html
https://access.redhat.com/security/vulnerabilities
http://lists.opensuse.org/opensuse-security-announce/2017-05/msg00077.htmlhttp://lists.opensuse.org/opensuse-security-announce/2017-05/msg00078.htmlhttp://lists.opensuse.org/opensuse-security-announce/2017-05/msg00079.htmlhttp://packetstormsecurity.com/files/142783/Sudo-get_process_ttyname-Race-Condition.htmlhttp://seclists.org/fulldisclosure/2017/Jun/3http://www.debian.org/security/2017/dsa-3867http://www.openwall.com/lists/oss-security/2017/05/30/16http://www.openwall.com/lists/oss-security/2022/12/22/5http://www.openwall.com/lists/oss-security/2022/12/22/6http://www.securityfocus.com/bid/98745http://www.securitytracker.com/id/1038582http://www.ubuntu.com/usn/USN-3304-1https://access.redhat.com/errata/RHSA-2017:1381https://access.redhat.com/errata/RHSA-2017:1382https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VXEXC4NNIG2QOZY6N2YUK246KI3D3UQO/https://security.gentoo.org/glsa/201705-15https://www.exploit-db.com/exploits/42183/https://www.sudo.ws/alerts/linux_tty.htmlhttp://lists.opensuse.org/opensuse-security-announce/2017-05/msg00077.htmlhttp://lists.opensuse.org/opensuse-security-announce/2017-05/msg00078.htmlhttp://lists.opensuse.org/opensuse-security-announce/2017-05/msg00079.htmlhttp://packetstormsecurity.com/files/142783/Sudo-get_process_ttyname-Race-Condition.htmlhttp://seclists.org/fulldisclosure/2017/Jun/3http://www.debian.org/security/2017/dsa-3867http://www.openwall.com/lists/oss-security/2017/05/30/16http://www.openwall.com/lists/oss-security/2022/12/22/5http://www.openwall.com/lists/oss-security/2022/12/22/6http://www.securityfocus.com/bid/98745http://www.securitytracker.com/id/1038582http://www.ubuntu.com/usn/USN-3304-1https://access.redhat.com/errata/RHSA-2017:1381https://access.redhat.com/errata/RHSA-2017:1382https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VXEXC4NNIG2QOZY6N2YUK246KI3D3UQO/https://security.gentoo.org/glsa/201705-15https://www.exploit-db.com/exploits/42183/https://www.sudo.ws/alerts/linux_tty.html
2017-06-05
Published
Exploited in the wild