@UK_Daniel_Card As if PHP2SHELL and now the Linux kernel TCP vulnerability rating a 9.8CVE weren't enough .. note that this is my first formal disclosure so go easy on me. SECURITY ADVISORY: CVE-2026-0000 (UNASSIGNED) CRITICAL: Local Privilege Escalation via User-Interactive Credential Reflection in sudo Severity: CRITICAL CVSS v3.1 Score: 9.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Affected Software: sudo (all versions) Platforms: Linux, macOS, BSD, and other UNIX-like operating systems. 1. Executive Summary A critical logic vulnerability has been identified in the sudo utility, a ubiquitous component of almost all UNIX-like operating systems. This vulnerability allows a local, unprivileged user to achieve instantaneous, unconstrained vertical privilege escalation to UID 0 (root). Unlike traditional privilege escalation vectors that rely on complex memory corruption (such as buffer overflows or use-after-free bugs), this exploit requires zero specialized knowledge, utilizes built-in command-line arguments, and boasts a 100% reliability rate across all affected architectures. 2. Vulnerability Details The vulnerability stems from a design flaw in how the sudo binary processes specific environment-altering flags, specifically -i (Interactive Context Injection) and -s (Shell Spawning). When an attacker executes the binary with either of these flags, the system initiates an interactive authentication prompt. The critical flaw is that the system evaluates the authentication against the attacker's own credentials rather than the target account (root). Once the attacker successfully inputs their own password, the binary inexplicably drops the user into a persistent, high-privileged TTY session without tearing down the connection. The state transition effectively bypasses the Principle of Least Privilege, granting the attacker the ability to bypass file system permissions, manipulate kernel modules, and alter system logs to cover their tracks. 3. Proof of Concept (PoC) The exploit can be triggered from any standard terminal emulator. The attacker must possess an unprivileged account on the target system. Step 1: Execute the injection vector The attacker invokes the vulnerable binary with the -i flag. $ sudo -i Step 2: Credential Reflection The system will prompt the attacker for a password. The attacker simply inputs their own password, exploiting the credential reflection flaw. [sudo] password for local_user: Step 3: Verification of Compromise Upon pressing Return, the attacker is immediately granted a root shell. The prompt typically changes from $ to #. # whoami root # id uid=0(root) gid=0(root) groups=0(root) At this point, the host is fully compromised. 4. Impact Assessment An attacker successfully leveraging this vector gains total control over the host operating system. Observed post-exploitation capabilities include: * Complete exfiltration of encrypted password hashes (/etc/shadow). * Arbitrary modification of the bootloader. * Installation of persistent rootkits. * Unrestricted access to all other users' home directories. 5. Remediation and Mitigation At this time, there is no patch available for the binary itself, as the vendor appears to consider this a "feature" of the application's architecture. However, system administrators can effectively mitigate this vulnerability by implementing strict access controls in the binary's configuration file. Mitigation Steps: * Open the configuration file using the dedicated safe-edit utility (do not edit directly): visudo * Locate the configuration matrix and identify any lines explicitly granting the ALL=(ALL:ALL) ALL permission set to user groups (commonly %wheel, %sudo, or %admin). * Remove or comment out these lines to neutralize the vulnerability. Warning: Implementing this mitigation will severely restrict the ability of administrators to perform system maintenance. Proceed with caution.