Skip to main content
VulnerabilityPublished Updated

CVE-2023-42465: sudo · CVE-2023-42465 is a

Affects sudoSource CVE Database V5

0

Not known to be exploited : upgrade to 1.9.15 soon.

Data as of 26 Oct 2026, 09:15 UTC

Severity
High

Rated High by the CNA (mitre) · No CVSS score from NVD or the CNA

EPSS
0.5% chance of exploitation in 30 days – higher than 45% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch
Available – fixed in 1.9.15

Exploitation evidence

  1. Disclosed: evidence found.

    CVE published 22 Dec 2023

  2. Detectable: no evidence on record.

    No public nuclei template indexed

  3. Weaponised: no evidence on record.

    No public exploit code indexed in Metasploit or Exploit-DB

  4. Exploited in the wild: no evidence on record.

    Not in CISA KEV and no source reports exploitation

  5. Observed by OffSeq Mirage: no evidence on record.

    No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

What to do

Upgrade the to 1.9.15.

Affected software

ProductAffectedFixed in
Debiandebian/sudopkg:deb/debian/sudoOther threatsAffected
  • <1.9.15
Fixed in
  • 1.9.15
Fedorafedora/sudopkg:rpm/fedora/sudoOther threatsAffected
  • <1.9.15
Fixed in
  • 1.9.15
Red Hatredhat/sudopkg:rpm/redhat/sudoOther threatsAffected
  • <1.9.15
Fixed in
  • 1.9.15

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

A fix for this vulnerability is available in sudo version 1.9.15. Users and administrators should upgrade to version 1.9.15 or later to remediate this issue. No additional mitigation steps are indicated by the vendor advisory.

Description

CVE-2023-42465 is a vulnerability in sudo versions prior to 1.9.15 that may allow row hammer attacks leading to authentication bypass or privilege escalation. The issue arises because the application logic relies on checking for non-equality to an error value rather than equality to a success value, combined with values that are susceptible to single-bit flips. This flaw was fixed in sudo version 1.9.15.

References

Community reviews

Loading reviews…