Fedora Account System
Red Hat Associate
Red Hat Customer
A flaw was found in sudo's handling of NOTBEFORE and NOTAFTER time-based authorization in sudoers rules. The parse_gentime() function in plugins/sudoers/gentime.c uses mktime() to interpret timestamps that lack a timezone suffix (no trailing 'Z' or explicit UTC offset). Because mktime() converts based on the process's TZ environment variable, and sudo is a setuid-root program that inherits the caller's environment, an unprivileged user can set TZ to an extreme POSIX timezone offset (e.g., TZ=XXX24) to shift the time evaluation window by up to ~25 hours in either direction. This allows expired NOTAFTER rules to appear valid, or not-yet-active NOTBEFORE rules to become usable. Authentication (PAM) is NOT bypassed; only the time-based authorization decision is affected. The feature was introduced in sudo 1.8.20. All versions from 1.8.20 through 1.9.17p2 are affected. The fix was committed to upstream main by Todd Miller on 2026-08-29 (commit 1820a349687522f51023d1ae5925125f59679a8c) but sudo 1.9.18 has not been released. Reported by Ermenson Junior (independent security researcher) on 2026-08-28. PSIRT Ticket: PSIRTSUPT-24357
Additional information: A public PoC / exploit for CVE-2026-96512 is available here: https://github.com/abraxas/cve-2026-96512 Red Hat CVE page: https://access.redhat.com/security/cve/cve-2026-96512 Since publicly available exploit code may increase the practical exploitation risk, could you please take this into account when prioritizing the affected-product analysis and remediation for RHEL? Thank you.