Skip to content

Commit a5aaae0

Browse files
azurelinux-securityazurelinux-security
authored
[AutoPR- Security] Patch sudo for CVE-2026-35535 [HIGH] (#16533)
1 parent b08fe4e commit a5aaae0

2 files changed

Lines changed: 154 additions & 1 deletion

File tree

‎SPECS/sudo/CVE-2026-35535.patch‎

Lines changed: 149 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,149 @@
1+
From 69ff97491d704e78b89a9e32e403d4b2b5c82d0b Mon Sep 17 00:00:00 2001
2+
From: "Todd C. Miller" <Todd.Miller@sudo.ws>
3+
Date: Sat, 8 Nov 2025 15:34:02 -0700
4+
Subject: [PATCH] exec_mailer: Set group as well as uid when running the mailer
5+
6+
Also make a setuid(), setgid() or setgroups() failure fatal.
7+
8+
Found by the ZeroPath AI Security Engineer <https://zeropath.com>
9+
10+
Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
11+
Upstream-reference: https://github.com/sudo-project/sudo/commit/3e474c2f201484be83d994ae10a4e20e8c81bb69.patch
12+
---
13+
include/sudo_eventlog.h | 3 ++-
14+
lib/eventlog/eventlog.c | 21 +++++++++++++++++----
15+
lib/eventlog/eventlog_conf.c | 4 +++-
16+
plugins/sudoers/logging.c | 2 +-
17+
plugins/sudoers/policy.c | 2 +-
18+
5 files changed, 24 insertions(+), 8 deletions(-)
19+
20+
diff --git a/include/sudo_eventlog.h b/include/sudo_eventlog.h
21+
index eb9f4f4..485d259 100644
22+
--- a/include/sudo_eventlog.h
23+
+++ b/include/sudo_eventlog.h
24+
@@ -80,6 +80,7 @@ struct eventlog_config {
25+
int syslog_rejectpri;
26+
int syslog_alertpri;
27+
uid_t mailuid;
28+
+ gid_t mailgid;
29+
bool omit_hostname;
30+
const char *logpath;
31+
const char *time_fmt;
32+
@@ -151,7 +152,7 @@ void eventlog_set_syslog_rejectpri(int pri);
33+
void eventlog_set_syslog_alertpri(int pri);
34+
void eventlog_set_syslog_maxlen(size_t len);
35+
void eventlog_set_file_maxlen(size_t len);
36+
-void eventlog_set_mailuid(uid_t uid);
37+
+void eventlog_set_mailuser(uid_t uid, gid_t gid);
38+
void eventlog_set_omit_hostname(bool omit_hostname);
39+
void eventlog_set_logpath(const char *path);
40+
void eventlog_set_time_fmt(const char *fmt);
41+
diff --git a/lib/eventlog/eventlog.c b/lib/eventlog/eventlog.c
42+
index 5a32824..d56c4e4 100644
43+
--- a/lib/eventlog/eventlog.c
44+
+++ b/lib/eventlog/eventlog.c
45+
@@ -304,15 +304,13 @@ exec_mailer(int pipein)
46+
syslog(LOG_ERR, _("unable to dup stdin: %m")); // -V618
47+
sudo_debug_printf(SUDO_DEBUG_ERROR,
48+
"unable to dup stdin: %s", strerror(errno));
49+
- sudo_debug_exit(__func__, __FILE__, __LINE__, sudo_debug_subsys);
50+
- _exit(127);
51+
+ goto bad;
52+
}
53+
54+
/* Build up an argv based on the mailer path and flags */
55+
if ((mflags = strdup(evl_conf->mailerflags)) == NULL) {
56+
syslog(LOG_ERR, _("unable to allocate memory")); // -V618
57+
- sudo_debug_exit(__func__, __FILE__, __LINE__, sudo_debug_subsys);
58+
- _exit(127);
59+
+ goto bad;
60+
}
61+
argv[0] = sudo_basename(mpath);
62+
63+
@@ -331,11 +329,23 @@ exec_mailer(int pipein)
64+
if (setuid(ROOT_UID) != 0) {
65+
sudo_debug_printf(SUDO_DEBUG_ERROR, "unable to change uid to %u",
66+
ROOT_UID);
67+
+ goto bad;
68+
+ }
69+
+ if (setgid(evl_conf->mailgid) != 0) {
70+
+ sudo_debug_printf(SUDO_DEBUG_ERROR, "unable to change gid to %u",
71+
+ (unsigned int)evl_conf->mailgid);
72+
+ goto bad;
73+
+ }
74+
+ if (setgroups(1, &evl_conf->mailgid) != 0) {
75+
+ sudo_debug_printf(SUDO_DEBUG_ERROR, "unable to set groups to %u",
76+
+ (unsigned int)evl_conf->mailgid);
77+
+ goto bad;
78+
}
79+
if (evl_conf->mailuid != ROOT_UID) {
80+
if (setuid(evl_conf->mailuid) != 0) {
81+
sudo_debug_printf(SUDO_DEBUG_ERROR, "unable to change uid to %u",
82+
(unsigned int)evl_conf->mailuid);
83+
+ goto bad;
84+
}
85+
}
86+
sudo_debug_exit(__func__, __FILE__, __LINE__, sudo_debug_subsys);
87+
@@ -347,6 +357,9 @@ exec_mailer(int pipein)
88+
sudo_debug_printf(SUDO_DEBUG_ERROR, "unable to execute %s: %s",
89+
mpath, strerror(errno));
90+
_exit(127);
91+
+bad:
92+
+ sudo_debug_exit(__func__, __FILE__, __LINE__, sudo_debug_subsys);
93+
+ _exit(127);
94+
}
95+
96+
/* Send a message to the mailto user */
97+
diff --git a/lib/eventlog/eventlog_conf.c b/lib/eventlog/eventlog_conf.c
98+
index 0663a38..ec3b569 100644
99+
--- a/lib/eventlog/eventlog_conf.c
100+
+++ b/lib/eventlog/eventlog_conf.c
101+
@@ -70,6 +70,7 @@ static struct eventlog_config evl_conf = {
102+
MAXSYSLOGLEN, /* syslog_maxlen */
103+
0, /* file_maxlen */
104+
ROOT_UID, /* mailuid */
105+
+ ROOT_GID, /* mailgid */
106+
false, /* omit_hostname */
107+
_PATH_SUDO_LOGFILE, /* logpath */
108+
"%h %e %T", /* time_fmt */
109+
@@ -151,9 +152,10 @@ eventlog_set_file_maxlen(size_t len)
110+
}
111+
112+
void
113+
-eventlog_set_mailuid(uid_t uid)
114+
+eventlog_set_mailuser(uid_t uid, gid_t gid)
115+
{
116+
evl_conf.mailuid = uid;
117+
+ evl_conf.mailgid = gid;
118+
}
119+
120+
void
121+
diff --git a/plugins/sudoers/logging.c b/plugins/sudoers/logging.c
122+
index bd4de92..9535289 100644
123+
--- a/plugins/sudoers/logging.c
124+
+++ b/plugins/sudoers/logging.c
125+
@@ -1157,7 +1157,7 @@ init_eventlog_config(void)
126+
eventlog_set_syslog_alertpri(def_syslog_badpri);
127+
eventlog_set_syslog_maxlen(def_syslog_maxlen);
128+
eventlog_set_file_maxlen(def_loglinelen);
129+
- eventlog_set_mailuid(ROOT_UID);
130+
+ eventlog_set_mailuser(ROOT_UID, ROOT_GID);
131+
eventlog_set_omit_hostname(!def_log_host);
132+
eventlog_set_logpath(def_logfile);
133+
eventlog_set_time_fmt(def_log_year ? "%h %e %T %Y" : "%h %e %T");
134+
diff --git a/plugins/sudoers/policy.c b/plugins/sudoers/policy.c
135+
index f3adfb0..27f6e58 100644
136+
--- a/plugins/sudoers/policy.c
137+
+++ b/plugins/sudoers/policy.c
138+
@@ -639,7 +639,7 @@ sudoers_policy_deserialize_info(struct sudoers_context *ctx, void *v,
139+
}
140+
141+
#ifdef NO_ROOT_MAILER
142+
- eventlog_set_mailuid(ctx->user.uid);
143+
+ eventlog_set_mailuser(ctx->user.uid, ctx->user.gid);
144+
#endif
145+
146+
/* Dump settings and user info (XXX - plugin args) */
147+
--
148+
2.45.4
149+

‎SPECS/sudo/sudo.spec‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
Summary: Sudo
22
Name: sudo
33
Version: 1.9.17
4-
Release: 1%{?dist}
4+
Release: 2%{?dist}
55
License: ISC
66
URL: https://www.sudo.ws/
77
Group: System Environment/Security
@@ -10,6 +10,7 @@ Distribution: Mariner
1010
Source0: https://www.sudo.ws/sudo/dist/%{name}-%{version}.tar.gz
1111
Patch0: CVE-2025-32462.patch
1212
Patch1: CVE-2025-32463.patch
13+
Patch2: CVE-2026-35535.patch
1314
BuildRequires: audit-devel
1415
BuildRequires: man-db
1516
BuildRequires: openssl-devel
@@ -101,6 +102,9 @@ fi
101102
%exclude /etc/sudoers.dist
102103

103104
%changelog
105+
* Thu Apr 09 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 1.9.17-2
106+
- Patch for CVE-2026-35535
107+
104108
* Fri Jun 27 2025 Pawel Winogrodzki <pawelwi@microsoft.com> - 1.9.17-1
105109
- Upgrade to version 1.9.17.
106110
- Patching CVEs: 2025-32462 and 2025-32463.

0 commit comments

Comments
 (0)