“The issue can only be leveraged with specific configurations using the Host or Host_Alias directives, which are commonly used in enterprise environments,” Stratascale warned.

“The issue arises from allowing an unprivileged user to invoke chroot() on a writable, untrusted path under their control. Sudo calls chroot() several times, regardless of whether the user has corresponding Sudo rule configured,” Stratascale explained.

Although it’s classed only as a low-severity bug, users are urged to update to Sudo 1.9.17p1 or later to mitigate the issue.