Sudo Before 1.9.15 Vulnerable to Row Hammer Attacks

CVE-2023-42465

Summary

A vulnerability in Sudo before version 1.9.15 exposes systems to row hammer attacks, potentially allowing unauthorized users to bypass authentication or escalate privileges. The issue arises due to flaws in application logic—specifically, relying on not equaling an error value rather than confirming a successful operation. This oversight, combined with inadequate resistance to single bit flips, creates an environment where attackers can exploit these weaknesses for elevated access.

References