The researchers were able to independently verify the vulnerability and exploit it in multiple ways to gain root privileges on Debian 10 with sudo 1.8.27; Ubuntu 20.04 and sudo 1.8.31; and Fedora 33 with sudo 1.9.2, according to Qualys. Other operating systems and distributions are likely vulnerable to the same issue.
No mitigations are available for the threat. Qualys recommends that all organizations using Unix and Linux distributions with sudo-enabled in them immediately implement vendor supplied patches or upgrade to sudo 1.9.5p2, the latest version of the utility. It was released this week.
"Patching is the only option," says Mehul Revankar, vice president of product management and engineering at Qualys.