CVE-2019-14287: Sudo policy bypass via crafted user ID in sudo -u

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityCVSS 8.8 with a very high EPSS percentile and public exploit detail make this a serious local privilege escalation, though it requires an existing Runas ALL sudoer account.

What it is

Sudo before 1.8.28 mishandles a crafted user ID passed to sudo -u, allowing an attacker who already holds a Runas ALL sudoer account to bypass policy blacklists and session PAM modules and to cause incorrect logging. The flaw undermines the intended restriction that a sudoer cannot run commands as root, so a limited sudo privilege can be escalated to full root execution.

Impact

An attacker with a Runas ALL sudoer entry gains root-level command execution and can evade logging and PAM session controls, effectively converting a restricted sudo grant into full administrative control of the host.

Attack surface

Reached locally by invoking sudo with a crafted numeric user ID such as sudo -u \#$((0xffffffff)); no user interaction beyond running the command is needed, but the attacker must already have a sudoers entry granting Runas ALL, so authentication as that sudoer account is required.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.63764, 99.18th percentile) and an oss-security reference is tagged Exploit, indicating public exploit detail is available. No ransomware group is documented as using it.

What to do

• Upgrade sudo to 1.8.28 or later on all affected systems, prioritizing Red Hat, Debian, Ubuntu, openSUSE and Fedora hosts.
• Audit sudoers for Runas ALL entries and tighten them to the specific target users or commands actually required.
• Remove or restrict !root blacklist-only configurations that rely on denying root, since this flaw bypasses them.
• Monitor vendor errata (RHSA/RHBA, Debian LTS, openSUSE, Fedora) and apply the corresponding package updates.
• Verify sudo version and sudoers policy on NetApp and container platform images that bundle sudo.

Detection

• Search sudo logs for invocations using numeric or negative user IDs, especially values like 4294967295 or -1, in sudo -u arguments.
• Alert on sudo commands where the logged target user does not match the expected Runas policy for that account.
• Correlate sudo events showing root command execution by accounts whose sudoers entry should not permit root.
• Hunt process accounting or auditd records for sudo -u with hex or arithmetic expressions in the user argument.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.