What’s Vulnerable › Vulnerabilities

CVE-2023-27320

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-02-28 · updated 2026-06-17
• Weakness: CWE-415

Description

Sudo before 1.9.13p2 has a double free in the per-command chroot feature.

Affected products

• Fedoraproject Fedora: 36, 37, 38
• sudo: from 1.9.8 before 1.9.13; 1.9.13, 1.9.13-p1 — fixed in 1.9.13

How to fix

Upgrade to a fixed version: sudo 1.9.13. Check the vendor advisory for mitigations.

References

• http://www.openwall.com/lists/oss-security/2023/03/01/8
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/332KN4QI6QXB7NI7SWSJ2EQJKWIILFN6/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FPLXMRAMXC3BYL4DNKVTK3V6JDMUXZ7B/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X6VW24YGXJYI4NZ5HZPQCF4MCE7766AU/
• https://security.gentoo.org/glsa/202309-12
• https://security.netapp.com/advisory/ntap-20230413-0009/
• https://www.openwall.com/lists/oss-security/2023/02/28/1
• https://www.sudo.ws/releases/stable/#1.9.13p2
• http://www.openwall.com/lists/oss-security/2023/03/01/8
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/332KN4QI6QXB7NI7SWSJ2EQJKWIILFN6/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FPLXMRAMXC3BYL4DNKVTK3V6JDMUXZ7B/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X6VW24YGXJYI4NZ5HZPQCF4MCE7766AU/

Get alerted when CVE-2023-27320 or the next vulnerability affects your stack