Bug 2539327 (CVE-2026-96512)

Summary:	CVE-2026-96512 sudo: sudo: TZ environment variable allows bypass of NOTBEFORE/NOTAFTER time-based authorization
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	akhatavk, akito5623, aos-team-art-private, asdas, cdrage, dpaolell, jdelft, jupierce, lgarciaa, mbiarnes, ppalepu, ppostler, prdhamdh, rhel-process-autobot, rushinde, sdawley, security-response-team, sghai, sidsharm, suppawar, vlaad, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone indicator, the time evaluation relies on the TZ environment variable inherited from the calling user. Because sudo is a setuid-root program, an unprivileged local user can set TZ to an extreme timezone offset to shift the authorization window by up to approximately 25 hours, causing expired rules to be treated as valid. This allows the user to execute commands outside the intended time window. Authentication is not bypassed; only the time-based authorization check is affected.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2539401
Bug Blocks:

Description OSIDB Bzimport 2026-09-23 10:35:19 UTC

A flaw was found in sudo's handling of NOTBEFORE and NOTAFTER time-based authorization in sudoers rules. The parse_gentime() function in plugins/sudoers/gentime.c uses mktime() to interpret timestamps that lack a timezone suffix (no trailing 'Z' or explicit UTC offset). Because mktime() converts based on the process's TZ environment variable, and sudo is a setuid-root program that inherits the caller's environment, an unprivileged user can set TZ to an extreme POSIX timezone offset (e.g., TZ=XXX24) to shift the time evaluation window by up to ~25 hours in either direction. This allows expired NOTAFTER rules to appear valid, or not-yet-active NOTBEFORE rules to become usable. Authentication (PAM) is NOT bypassed; only the time-based authorization decision is affected.

The feature was introduced in sudo 1.8.20. All versions from 1.8.20 through 1.9.17p2 are affected. The fix was committed to upstream main by Todd Miller on 2026-08-29 (commit 1820a349687522f51023d1ae5925125f59679a8c) but sudo 1.9.18 has not been released.

Reported by Ermenson Junior (independent security researcher) on 2026-08-28.
PSIRT Ticket: PSIRTSUPT-24357

Comment 2 Akiyoshi Kurita 2026-09-28 11:15:40 UTC

Additional information:

A public PoC / exploit for CVE-2026-96512 is available here:

https://github.com/abraxas/cve-2026-96512

Red Hat CVE page:
https://access.redhat.com/security/cve/cve-2026-96512

Since publicly available exploit code may increase the practical exploitation risk, could you please take this into account when prioritizing the affected-product analysis and remediation for RHEL?

Thank you.