CVE-2015-8239

The SHA-2 digest support in the sudoers plugin in sudo after 1.8.7 allows local users with write...

7.0 HighPublic exploitFix available

CVE-2015-8239 is a high vulnerability (CVSS 7.0) in Sudo Project Sudo, published July 26, 2016. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.54%, the 45th percentile. Fixed in sudo 1.8.17p1-1.

The SHA-2 digest support in the sudoers plugin in sudo after 1.8.7 allows local users with write permissions to parts of the called command to replace them before it is executed.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: High
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.54%Down 1.1 points since Feb 4, 2022

What each source reports

NVD Score used 7.0

The SHA-2 digest support in the sudoers plugin in sudo after 1.8.7 allows local users with write permissions to parts of the called command to replace them before it is executed.

Record: CVE-2015-8239
CVSS 3.0: 7.0 HighCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 6.9 MediumAV:L/AC:M/Au:N/C:C/I:C/A:C
Weakness: CWE-362
Updated: 2026-11-02

CVE List No score

The SHA-2 digest support in the sudoers plugin in sudo after 1.8.7 allows local users with write permissions to parts of the called command to replace them before it is executed.

Record: CVE-2015-8239
Updated: 2026-11-02

EUVDEUVD-2015-8127 No score

The SHA-2 digest support in the sudoers plugin in sudo after 1.8.7 allows local users with write permissions to parts of the called command to replace them before it is executed.

Record: EUVD-2015-8127
Updated: 2026-11-03

GitHub AdvisoriesGHSA-w2j3-vrwq-vgh5 7.0

The SHA-2 digest support in the sudoers plugin in sudo after 1.8.7 allows local users with write...

The SHA-2 digest support in the sudoers plugin in sudo after 1.8.7 allows local users with write permissions to parts of the called command to replace them before it is executed.

Record: GHSA-w2j3-vrwq-vgh5
CVSS 3.0: 7.0 HighCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-362
Updated: 2026-11-02

OSV 7.0

The SHA-2 digest support in the sudoers plugin in sudo after 1.8.7 allows local users with write permissions to parts of the called command to replace them before it is executed.

Record: CVE-2015-8239
CVSS 3.0: 7.0 HighCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2015-8239 7.0

The SHA-2 digest support in the sudoers plugin in sudo after 1.8.7 allows local users with write permissions to parts of the called command to replace them before it is executed.

Record: DEBIAN-CVE-2015-8239
CVSS 3.0: 7.0 HighCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2015-8239 7.0

The SHA-2 digest support in the sudoers plugin in sudo after 1.8.7 allows local users with write permissions to parts of the called command to replace them before it is executed.

Record: UBUNTU-CVE-2015-8239
CVSS 3.0: 7.0 HighCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVMGASA-2016-0261 No score

Updated sudo packages fix security vulnerability

A vulnerability in functionality for adding support of SHA-2 digests along with the command was found. The sudoers plugin performs this digest verification while matching rules, and later independently calls execve() to execute the binary. This results in a race condition if the digest functionality is used as suggested (in fact, the rules are matched before the user is prompted for a password, so there is not negligible time frame to replace the binary from underneath sudo) (CVE-2015-8239).

Record: MGASA-2016-0261
Updated: 2026-11-02

Affected products

sudo project sudo

Affected packages

Affected packages
Package	Affected	Fixed
`sudo` Debian:12	before 1.8.17p1-1	1.8.17p1-1
`sudo` Debian:13	before 1.8.17p1-1	1.8.17p1-1
`sudo` Debian:14	before 1.8.17p1-1	1.8.17p1-1
`sudo` Mageia:5	before 1.8.17p1-1.mga5	1.8.17p1-1.mga5
`sudo` Ubuntu:Pro:14.04:LTS	All versions, plus listed versions 1.8.6p3-0ubuntu31.8.8-2ubuntu11.8.8-2ubuntu21.8.9p4-1ubuntu11.8.9p4-1ubuntu2 Show 12 moreShow less 1.8.9p5-1ubuntu11.8.9p5-1ubuntu1.11.8.9p5-1ubuntu1.21.8.9p5-1ubuntu1.31.8.9p5-1ubuntu1.41.8.9p5-1ubuntu1.5+esm11.8.9p5-1ubuntu1.5+esm21.8.9p5-1ubuntu1.5+esm31.8.9p5-1ubuntu1.5+esm51.8.9p5-1ubuntu1.5+esm61.8.9p5-1ubuntu1.5+esm71.8.9p5-1ubuntu1.5+esm8	None known

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
PoC in GitHub	justinsteven/sudo_digest_toctou_poc_CVE-2015-8239	2021-01-15

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub

References

Show 9 moreShow less