CVE-2017-1000367

Todd Miller's sudo version 1.8.20 and earlier is vulnerable to an input validation (embedded...

6.4 MediumPublic exploitFix available

Todd Miller's sudo version 1.8.20 and earlier is vulnerable to an input validation (embedded spaces) in the get_process_ttyname() function resulting in information disclosure and command execution.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: High
Privileges needed: High
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

8.07%Down 14.1 points since Apr 14, 2021

What each source reports

NVD Score used 6.4

Todd Miller's sudo version 1.8.20 and earlier is vulnerable to an input validation (embedded spaces) in the get_process_ttyname() function resulting in information disclosure and command execution.

Record: CVE-2017-1000367
CVSS 3.0: 6.4 MediumCVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 6.9 MediumAV:L/AC:M/Au:N/C:C/I:C/A:C
Weakness: CWE-362
Updated: 2026-11-02

CVE List No score

Todd Miller's sudo version 1.8.20 and earlier is vulnerable to an input validation (embedded spaces) in the get_process_ttyname() function resulting in information disclosure and command execution.

Record: CVE-2017-1000367
Updated: 2026-11-02

EUVDEUVD-2017-1526 No score

Todd Miller's sudo version 1.8.20 and earlier is vulnerable to an input validation (embedded spaces) in the get_process_ttyname() function resulting in information disclosure and command execution.

Record: EUVD-2017-1526
Updated: 2026-11-03

GitHub AdvisoriesGHSA-4c2x-g299-mpv8 6.4

Todd Miller's sudo version 1.8.20 and earlier is vulnerable to an input validation (embedded...

Todd Miller's sudo version 1.8.20 and earlier is vulnerable to an input validation (embedded spaces) in the get_process_ttyname() function resulting in information disclosure and command execution.

Record: GHSA-4c2x-g299-mpv8
CVSS 3.0: 6.4 MediumCVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-362
Updated: 2026-11-02

OSVBELL-CVE-2017-1000367 6.4

CVE-2017-1000367 does not affect BellSoft software

Record: BELL-CVE-2017-1000367
CVSS 3.0: 6.4 MediumCVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSV 6.4

Todd Miller's sudo version 1.8.20 and earlier is vulnerable to an input validation (embedded spaces) in the get_process_ttyname() function resulting in information disclosure and command execution.

Record: CVE-2017-1000367
CVSS 3.0: 6.4 MediumCVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 9 moreShow less

OSVDEBIAN-CVE-2017-1000367 6.4

Todd Miller's sudo version 1.8.20 and earlier is vulnerable to an input validation (embedded spaces) in the get_process_ttyname() function resulting in information disclosure and command execution.

Record: DEBIAN-CVE-2017-1000367
CVSS 3.0: 6.4 MediumCVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2017:1381 7.8

Red Hat Security Advisory: sudo security update

Record: RHSA-2017:1381
CVSS 3.0: 7.8 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2017:1382 7.8

Red Hat Security Advisory: sudo security update

Record: RHSA-2017:1382
CVSS 3.0: 7.8 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2017-1000367 6.4

Todd Miller's sudo version 1.8.20 and earlier is vulnerable to an input validation (embedded spaces) in the get_process_ttyname() function resulting in information disclosure and command execution.

Record: UBUNTU-CVE-2017-1000367
CVSS 3.0: 6.4 MediumCVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVMGASA-2017-0207 No score

Updated sudo packages fix security vulnerability

A flaw was found in the way sudo parsed tty information from the process status file in the proc filesystem. A local user with privileges to execute commands via sudo could use this flaw to escalate their privileges to root. (CVE-2017-1000367)

Record: MGASA-2017-0207
Updated: 2026-11-02

OSVopenSUSE-SU-2024:11413-1 No score

sudo-1.9.7p2-1.4 on GA media

These are all security issues fixed in the sudo-1.9.7p2-1.4 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:11413-1
Updated: 2026-11-02

OSVSUSE-SU-2017:1446-1 No score

Security update for sudo

This update for sudo fixes the following issues:

CVE-2017-1000367:

Due to incorrect assumptions in /proc/[pid]/stat parsing, a local attacker can pretend that his tty is any file on the filesystem, thus gaining arbitrary file write access on SELinux-enabled systems. [bsc#1039361]
Fix FQDN for hostname. [bsc#1024145]
Filter netgroups, they aren't handled by SSSD. [bsc#1015351]
Fix problems related to 'krb5_ccname' option [bsc#981124]

Record: SUSE-SU-2017:1446-1
Updated: 2026-11-02

OSVSUSE-SU-2017:1450-1 No score

Security update for sudo

This update for sudo fixes the following issues:

CVE-2017-1000367:

Due to incorrect assumptions in /proc/[pid]/stat parsing, a local attacker can pretend that his tty is any file on the filesystem, thus gaining arbitrary file write access on SELinux-enabled systems. [bsc#1039361]
Fix FQDN for hostname. [bsc#1024145]
Filter netgroups, they aren't handled by SSSD. [bsc#1015351]
Fix problems related to 'krb5_ccname' option [bsc#981124]

Record: SUSE-SU-2017:1450-1
Updated: 2026-11-02

OSVUSN-3304-1 No score

sudo vulnerability

It was discovered that Sudo did not properly parse the contents of /proc/[pid]/stat when attempting to determine its controlling tty. A local attacker in some configurations could possibly use this to overwrite any file on the filesystem, bypassing intended permissions.

Record: USN-3304-1
Updated: 2026-11-02

Affected products

sudo project sudo

Affected packages

Affected packages
Package	Affected	Fixed
`sudo` Debian:12	before 1.8.20p1-1	1.8.20p1-1
`sudo` Debian:13	before 1.8.20p1-1	1.8.20p1-1
`sudo` Debian:14	before 1.8.20p1-1	1.8.20p1-1
`sudo` Debian:7	before 1.8.5p2-1+nmu3+deb7u3, plus listed versions 1.8.5p2-1+nmu11.8.5p2-1+nmu21.8.5p2-1+nmu31.8.5p2-1+nmu3+deb7u11.8.5p2-1+nmu3+deb7u2	1.8.5p2-1+nmu3+deb7u3
`sudo` Debian:8	before 1.8.10p3-1+deb8u4, plus listed versions 1.8.10p3-1+deb8u21.8.10p3-1+deb8u3	1.8.10p3-1+deb8u4
`sudo` Mageia:5	before 1.8.20p2-1.mga5	1.8.20p2-1.mga5
`sudo` Red Hat:rhel_els:5	before 0:1.7.2p1-30.el5_11	0:1.7.2p1-30.el5_11
`sudo-debuginfo` Red Hat:rhel_els:5	before 0:1.7.2p1-30.el5_11	0:1.7.2p1-30.el5_11
`sudo` Red Hat:enterprise_linux:6::client	before 0:1.8.6p3-28.el6_9	0:1.8.6p3-28.el6_9
`sudo-debuginfo` Red Hat:enterprise_linux:6::client	before 0:1.8.6p3-28.el6_9	0:1.8.6p3-28.el6_9

Show 36 moreShow less

Affected packages
Package	Affected	Fixed
`sudo-devel` Red Hat:enterprise_linux:6::client	before 0:1.8.6p3-28.el6_9	0:1.8.6p3-28.el6_9
`sudo` Red Hat:enterprise_linux:6::computenode	before 0:1.8.6p3-28.el6_9	0:1.8.6p3-28.el6_9
`sudo-debuginfo` Red Hat:enterprise_linux:6::computenode	before 0:1.8.6p3-28.el6_9	0:1.8.6p3-28.el6_9
`sudo-devel` Red Hat:enterprise_linux:6::computenode	before 0:1.8.6p3-28.el6_9	0:1.8.6p3-28.el6_9
`sudo` Red Hat:enterprise_linux:6::server	before 0:1.8.6p3-28.el6_9	0:1.8.6p3-28.el6_9
`sudo-debuginfo` Red Hat:enterprise_linux:6::server	before 0:1.8.6p3-28.el6_9	0:1.8.6p3-28.el6_9
`sudo-devel` Red Hat:enterprise_linux:6::server	before 0:1.8.6p3-28.el6_9	0:1.8.6p3-28.el6_9
`sudo` Red Hat:enterprise_linux:6::workstation	before 0:1.8.6p3-28.el6_9	0:1.8.6p3-28.el6_9
`sudo-debuginfo` Red Hat:enterprise_linux:6::workstation	before 0:1.8.6p3-28.el6_9	0:1.8.6p3-28.el6_9
`sudo-devel` Red Hat:enterprise_linux:6::workstation	before 0:1.8.6p3-28.el6_9	0:1.8.6p3-28.el6_9
`sudo` Red Hat:enterprise_linux:7::client	before 0:1.8.6p7-22.el7_3	0:1.8.6p7-22.el7_3
`sudo-debuginfo` Red Hat:enterprise_linux:7::client	before 0:1.8.6p7-22.el7_3	0:1.8.6p7-22.el7_3
`sudo-devel` Red Hat:enterprise_linux:7::client	before 0:1.8.6p7-22.el7_3	0:1.8.6p7-22.el7_3
`sudo` Red Hat:enterprise_linux:7::computenode	before 0:1.8.6p7-22.el7_3	0:1.8.6p7-22.el7_3
`sudo-debuginfo` Red Hat:enterprise_linux:7::computenode	before 0:1.8.6p7-22.el7_3	0:1.8.6p7-22.el7_3
`sudo-devel` Red Hat:enterprise_linux:7::computenode	before 0:1.8.6p7-22.el7_3	0:1.8.6p7-22.el7_3
`sudo` Red Hat:enterprise_linux:7::server	before 0:1.8.6p7-22.el7_3	0:1.8.6p7-22.el7_3
`sudo-debuginfo` Red Hat:enterprise_linux:7::server	before 0:1.8.6p7-22.el7_3	0:1.8.6p7-22.el7_3
`sudo-devel` Red Hat:enterprise_linux:7::server	before 0:1.8.6p7-22.el7_3	0:1.8.6p7-22.el7_3
`sudo` Red Hat:enterprise_linux:7::workstation	before 0:1.8.6p7-22.el7_3	0:1.8.6p7-22.el7_3
`sudo-debuginfo` Red Hat:enterprise_linux:7::workstation	before 0:1.8.6p7-22.el7_3	0:1.8.6p7-22.el7_3
`sudo-devel` Red Hat:enterprise_linux:7::workstation	before 0:1.8.6p7-22.el7_3	0:1.8.6p7-22.el7_3
`sudo` SUSE:Linux Enterprise Desktop 12 SP1	before 1.8.10p3-2.11.1	1.8.10p3-2.11.1
`sudo` SUSE:Linux Enterprise Server for SAP Applications 12	before 1.8.10p3-2.11.1	1.8.10p3-2.11.1
`sudo` SUSE:Linux Enterprise Software Development Kit 12 SP1	before 1.8.10p3-2.11.1	1.8.10p3-2.11.1
`sudo` SUSE:Linux Enterprise Server 12-LTSS	before 1.8.10p3-2.11.1	1.8.10p3-2.11.1
`sudo` SUSE:Linux Enterprise Server 12 SP1	before 1.8.10p3-2.11.1	1.8.10p3-2.11.1
`sudo` SUSE:Linux Enterprise Server for SAP Applications 12 SP1	before 1.8.10p3-2.11.1	1.8.10p3-2.11.1
`sudo` SUSE:Linux Enterprise Desktop 12 SP2	before 1.8.10p3-10.5.1	1.8.10p3-10.5.1
`sudo` SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2	before 1.8.10p3-10.5.1	1.8.10p3-10.5.1
`sudo` SUSE:Linux Enterprise Software Development Kit 12 SP2	before 1.8.10p3-10.5.1	1.8.10p3-10.5.1
`sudo` SUSE:Linux Enterprise Server 12 SP2	before 1.8.10p3-10.5.1	1.8.10p3-10.5.1
`sudo` SUSE:Linux Enterprise Server for SAP Applications 12 SP2	before 1.8.10p3-10.5.1	1.8.10p3-10.5.1
`sudo` Ubuntu:14.04:LTS	before 1.8.9p5-1ubuntu1.4, plus listed versions 1.8.6p3-0ubuntu31.8.8-2ubuntu11.8.8-2ubuntu21.8.9p4-1ubuntu11.8.9p4-1ubuntu2 Show 4 moreShow less 1.8.9p5-1ubuntu11.8.9p5-1ubuntu1.11.8.9p5-1ubuntu1.21.8.9p5-1ubuntu1.3	1.8.9p5-1ubuntu1.4
`sudo` Ubuntu:16.04:LTS	before 1.8.16-0ubuntu1.4, plus listed versions 1.8.12-1ubuntu31.8.16-0ubuntu11.8.16-0ubuntu1.11.8.16-0ubuntu1.21.8.16-0ubuntu1.3	1.8.16-0ubuntu1.4
`sudo` openSUSE:Tumbleweed From an advisory covering 11 CVEs	before 1.9.7p2-1.4	1.9.7p2-1.4

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
PoC in GitHub	c0d3z3r0/sudo-CVE-2017-1000367	2017-05-30
PoC in GitHub	homjxi0e/CVE-2017-1000367	2017-06-04
PoC in GitHub	pucerpocok/sudo_exploit	2017-06-08
Exploit-DB	Sudo 1.8.20 - 'get_process_ttyname()' Local Privilege Escalation	2017-06-14
PoC in GitHub	letsr00t/CVE-2017-1000367	2025-10-17

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, exploits, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2017-1000367 is a medium vulnerability (CVSS 6.4) in Sudo Project Sudo, published May 30, 2017. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 8.07%, the 94th percentile. Fixed in sudo 1.8.20p1-1.

References

Show 46 moreShow less