Dear deepin users and community partners:

Recently, we detected a time-window authorization bypass vulnerability in sudo. Under certain conditions, an attacker can cause expired or not-yet-effective sudo authorization rules to be incorrectly judged as valid, thereby obtaining root privileges outside the intended time period. At present, the technical details for exploiting this vulnerability have been made public. Given its severity and broad impact, to ensure the security of your system, we recommend that all users upgrade as soon as possible.

Vulnerability Information

Vulnerability ID:  CVE-2026-96512

Vulnerability Description:

This vulnerability originates from a flaw (CWE-863) in sudo’s authorization validation of time-based access restrictions (NOTBEFORE/NOTAFTER) in sudoers rules.

When the timestamp in a rule does not have the UTC suffix Z, sudo uses mktime() to parse the time, and mktime() reads the TZ environment variable of the calling process, making the time-window evaluation controllable by the caller.

When a local ordinary user is authorized by such a time-window rule, by setting TZ to an extreme time zone offset (such as UTC+14), they can shift the time window by up to about 25 hours forward or backward, causing expired or not-yet-effective rules to be incorrectly judged as valid, thereby executing sudo commands that should not be allowed outside the intended period and achieving local privilege escalation to root.

This vulnerability was disclosed through public channels on 2026-09-23 (Red Hat security advisory, oss-security), affecting sudo 1.8.20 through 1.9.17p2 and versions before the fix on the main branch; the upstream fix commit is 1820a34 (removing the TZ environment variable from sudo’s working environment).

Vulnerability Severity: High severity (CVSS 7.8).

Exploitation conditions:

A NOTBEFORE or NOTAFTER time-window rule that applies to the attacker exists in sudoers, and the timestamp does not have the UTC suffix Z (default configurations usually do not contain such rules); the attacker is the authorized subject of that rule and has local authenticated user privileges; the attacker can control the TZ environment variable when invoking sudo.

 

Scope of Impact

All deepin 25 users who have not updated with this fix are affected. It is recommended to update and upgrade immediately.

 

Fix Progress

Fix progress for deepin 25 (6.6 and 6.18 kernels): The vulnerability fix update for deepin 25 has been pushed. Please update as soon as possible through the Control Center, or upgrade using the terminal command:

sudo apt update && sudo apt dist-upgrade

After upgrading, please restart the system to ensure the fix takes effect.

 

That is all for this update. Thank you again to every deepin community friend for your support!