CVE-2017-1000367
sudo: Privilege escalation in via improper get_process_ttyname() parsing
Loading…
Severity
ImportantRed Hat Product Security
CVSS 3.0
Review impact separately from score.
Published · May 30, 2017
Updated · May 13, 2026
Description
A flaw was found in the way sudo parsed tty information from the process status file in the proc filesystem. A local user with privileges to execute commands via sudo could use this flaw to escalate their privileges to root.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.0 · 7.8CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-807 · Reliance on Untrusted Inputs in a Security Decision