Sudo CVE-2023-22809 Analysis

Tue, 21 Apr 2026 20:21:33 +0800

1. Introduction

If there is one binary that every Linux user has typed at least once, it’s sudo. It is so deeply embedded in the muscle memory of sysadmins and developers alike that most people don’t even think twice about it. But CVE-2023-22809, discovered by Matthieu Barjole and Victor Cutillas of Synacktiv, reminds us that even the most trusted tools can hide dangerous bugs.

This vulnerability is a privilege escalation in sudoedit (sudo’s built-in file editing mode). By injecting a -- separator into an environment variable like EDITOR, a local attacker can trick sudo into editing arbitrary files as root, even if the sudoers policy only permits editing a single, specific file.

Sudo on Mathscantor's Cybersecurity Blog

Sudo CVE-2023-22809 Analysis

1. Introduction