DescriptionIn Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged sudo process. (pwfeedback is a default setting in Linux Mint and elementary OS; however, it is NOT the default for upstream and many other packages, and would exist only if enabled by an administrator.) The attacker needs to deliver a long string to the stdin of getln() in tgetpass.c.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-2094-1, DSA-4614-1, ELA-213-1
Debian Bugs950371

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
sudo (PTS)jessie, jessie (lts)1.8.10p3-1+deb8u9fixed
stretch (security)1.8.19p1-2.1+deb9u3fixed
stretch (lts), stretch1.8.19p1-2.1+deb9u6fixed
buster (security)1.8.27-1+deb10u6fixed
bullseye (security), bullseye1.9.5p2-3+deb11u1fixed
sid, trixie1.9.15p5-3fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs

Notes (master) (SUDO_1_8_31)
The issue itself is fixed only in 1.8.31 but a change in the EOF handling
introduced in 1.8.26 mitigated exploitation of the bug in some cases:
Change for "Print a warning for password read issues" in 1.8.26: (SUDO_1_8_26)
The overflow is tough as well reachable when using a pty:

Search for package or bug name: Reporting problems