Ubuntu alert USN-8708-1 (rust-sudo-rs)

From:
             
 
noreply+usn-bot--- via ubuntu-security-announce <ubuntu-security-announce@lists.ubuntu.com>
To:
             
 
ubuntu-security-announce@lists.ubuntu.com
Subject:
             
 
[USN-8708-1] sudo-rs vulnerability
Date:
             
 
Tue, 01 Sep 2026 15:37:08 +0000
Message-ID:
             
 
<E1x1QXs-0005tS-6g@lists.ubuntu.com>
Cc:
             
 
noreply+usn-bot@canonical.com
==========================================================================
Ubuntu Security Notice USN-8708-1
September 01, 2026

rust-sudo-rs vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 26.04 LTS

Summary:

sudo-rs could be made to run programs as an administrator.

Software Description:
- rust-sudo-rs: Rust-based sudo and su implementations

Details:

It was discovered that sudo-rs incorrectly handled time-of-check vs time-
of-use conditions in sudoedit. A local attacker with permission to edit
specific files using sudoedit could use this issue to place files in
arbitrary directories, and possibly escalate their privileges. This issue
only affected systems configured to grant fine-grained sudoedit file
editing permissions, which is not the default configuration.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 26.04 LTS
  sudo-rs                         0.2.13-0ubuntu1.2

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-8708-1
  https://bugs.launchpad.net/bugs/2165142

Package Information:
  https://launchpad.net/ubuntu/+source/rust-sudo-rs/0.2.13-...


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmqW8RkACgkQcpJm3tlz
hgFYHA//aI6DPFKX2dKHDIdP9e4R4NN5tZ2gGkC7840gAhYDjj2NUqd2/82WmnO7
zuz37IBaKr0B8Kreuz3jJwCP5plC9Vn9vrStEgxV7xhp3waB8ppl5+XxTZ20V7Uq
qmjUyqVkyJJVnMOmlJCKKPAdwEZN/MgPXUH7ffOnolX2dXr2xDPf/gBTNxBTa/D6
99BwhUiPF5Vg75PdgmG/iv4wFnwa1M/eO9vYqzgXqhXzaTfi2lsoH5lshHRa4vns
9PkGcY8etdvZO9uLZIzm7zjn6D1wBg5LiswwpA+ZlohnwneB64TTsXz0hlMX7/aQ
rvFR3DkdAAMusg2IZal0RANmcZUccmfgrVifHkmbIiqKi0gHrTuQ5DeWdNfey6CH
r5HtDdSRMY5eRyEOZPcGeKt3vr12XpT7N7nRcBB9uIZox/69SnfMcyAWgkFqlH/q
XKFaH4XoV9h6zPZI+yqBf9ltbcqSfeCEhaSU7lkhIL11MtrlfIW8TrFyI7ynCrLp
FaZFX3jldrk/sFKIcQcG+s2XQDVYxh9YE4bc1oPKkOvytaJql6I6Ql4CjxTXmUtG
aJownT9orMHeP6hR4dw4IeFVrsjT12Fgk7YlW5zDSgUYOIpWCnigc3Z7fKTatGmZ
2eF8kN18n+mSjRYs4B+h3dOhSGSHPcRzpkaTaoMtzuTnOJEOKvs=
=3edB
-----END PGP SIGNATURE-----