Skip to content

Commit d14b2a3

Browse files
deepin-ci-robotZeno-sole
deepin-ci-robot
authored and
Zeno-sole
committed
fix: Fix CVE-2026-35535 - exec_mailer privilege escalation vulnerability
- Set group as well as uid when running the mailer - Make setuid(), setgid() or setgroups() failure fatal - Add mailgid field to eventlog_config structure - Update eventlog_set_mailuid() to eventlog_set_mailuser() with gid parameter Upstream: https://www.sudo.ws/security/advisories/CVE-2026-35535/
1 parent 068e705 commit d14b2a3

3 files changed

Lines changed: 149 additions & 0 deletions

File tree

‎debian/changelog‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,10 @@
1+
sudo (1.9.16p2-3deepin2) unstable; urgency=medium
2+
3+
* Fix CVE-2026-35535: exec_mailer: Set group as well as uid when
4+
running the mailer.
5+
6+
-- deepin-ci-robot <packages@deepin.org> Mon, 13 Apr 2026 21:24:10 +0800
7+
18
sudo (1.9.16p2-3deepin1) unstable; urgency=medium
29

310
[ zhouzilong ]

‎debian/patches/cve_2026_35535.patch‎

Lines changed: 141 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,141 @@
1+
Description: exec_mailer: Set group as well as uid when running the mailer.
2+
Also make a setuid(), setgid() or setgroups() failure fatal.
3+
Author: Todd C. Miller <Todd.Miller@sudo.ws>
4+
Origin: upstream
5+
Bug: https://security-tracker.debian.org/tracker/CVE-2026-35535
6+
Forwarded: not-needed
7+
Last-Update: 2026-04-13
8+
---
9+
include/sudo_eventlog.h | 3 ++-
10+
lib/eventlog/eventlog.c | 21 +++++++++++++++++----
11+
lib/eventlog/eventlog_conf.c | 4 +++-
12+
plugins/sudoers/logging.c | 2 +-
13+
plugins/sudoers/policy.c | 2 +-
14+
5 files changed, 24 insertions(+), 8 deletions(-)
15+
Index: github-sudo-CVE-2026-35535/include/sudo_eventlog.h
16+
===================================================================
17+
--- github-sudo-CVE-2026-35535.orig/include/sudo_eventlog.h
18+
+++ github-sudo-CVE-2026-35535/include/sudo_eventlog.h
19+
@@ -80,6 +80,7 @@ struct eventlog_config {
20+
int syslog_rejectpri;
21+
int syslog_alertpri;
22+
uid_t mailuid;
23+
+ gid_t mailgid;
24+
bool omit_hostname;
25+
const char *logpath;
26+
const char *time_fmt;
27+
@@ -151,7 +152,7 @@ void eventlog_set_syslog_rejectpri(int p
28+
void eventlog_set_syslog_alertpri(int pri);
29+
void eventlog_set_syslog_maxlen(size_t len);
30+
void eventlog_set_file_maxlen(size_t len);
31+
-void eventlog_set_mailuid(uid_t uid);
32+
+void eventlog_set_mailuser(uid_t uid, gid_t gid);
33+
void eventlog_set_omit_hostname(bool omit_hostname);
34+
void eventlog_set_logpath(const char *path);
35+
void eventlog_set_time_fmt(const char *fmt);
36+
Index: github-sudo-CVE-2026-35535/lib/eventlog/eventlog.c
37+
===================================================================
38+
--- github-sudo-CVE-2026-35535.orig/lib/eventlog/eventlog.c
39+
+++ github-sudo-CVE-2026-35535/lib/eventlog/eventlog.c
40+
@@ -304,15 +304,13 @@ exec_mailer(int pipein)
41+
syslog(LOG_ERR, _("unable to dup stdin: %m")); // -V618
42+
sudo_debug_printf(SUDO_DEBUG_ERROR,
43+
"unable to dup stdin: %s", strerror(errno));
44+
- sudo_debug_exit(__func__, __FILE__, __LINE__, sudo_debug_subsys);
45+
- _exit(127);
46+
+ goto bad;
47+
}
48+
49+
/* Build up an argv based on the mailer path and flags */
50+
if ((mflags = strdup(evl_conf->mailerflags)) == NULL) {
51+
syslog(LOG_ERR, _("unable to allocate memory")); // -V618
52+
- sudo_debug_exit(__func__, __FILE__, __LINE__, sudo_debug_subsys);
53+
- _exit(127);
54+
+ goto bad;
55+
}
56+
argv[0] = sudo_basename(mpath);
57+
58+
@@ -331,11 +329,23 @@ exec_mailer(int pipein)
59+
if (setuid(ROOT_UID) != 0) {
60+
sudo_debug_printf(SUDO_DEBUG_ERROR, "unable to change uid to %u",
61+
ROOT_UID);
62+
+ goto bad;
63+
+ }
64+
+ if (setgid(evl_conf->mailgid) != 0) {
65+
+ sudo_debug_printf(SUDO_DEBUG_ERROR, "unable to change gid to %u",
66+
+ (unsigned int)evl_conf->mailgid);
67+
+ goto bad;
68+
+ }
69+
+ if (setgroups(1, &evl_conf->mailgid) != 0) {
70+
+ sudo_debug_printf(SUDO_DEBUG_ERROR, "unable to set groups to %u",
71+
+ (unsigned int)evl_conf->mailgid);
72+
+ goto bad;
73+
}
74+
if (evl_conf->mailuid != ROOT_UID) {
75+
if (setuid(evl_conf->mailuid) != 0) {
76+
sudo_debug_printf(SUDO_DEBUG_ERROR, "unable to change uid to %u",
77+
(unsigned int)evl_conf->mailuid);
78+
+ goto bad;
79+
}
80+
}
81+
sudo_debug_exit(__func__, __FILE__, __LINE__, sudo_debug_subsys);
82+
@@ -347,6 +357,9 @@ exec_mailer(int pipein)
83+
sudo_debug_printf(SUDO_DEBUG_ERROR, "unable to execute %s: %s",
84+
mpath, strerror(errno));
85+
_exit(127);
86+
+bad:
87+
+ sudo_debug_exit(__func__, __FILE__, __LINE__, sudo_debug_subsys);
88+
+ _exit(127);
89+
}
90+
91+
/* Send a message to the mailto user */
92+
Index: github-sudo-CVE-2026-35535/lib/eventlog/eventlog_conf.c
93+
===================================================================
94+
--- github-sudo-CVE-2026-35535.orig/lib/eventlog/eventlog_conf.c
95+
+++ github-sudo-CVE-2026-35535/lib/eventlog/eventlog_conf.c
96+
@@ -70,6 +70,7 @@ static struct eventlog_config evl_conf =
97+
MAXSYSLOGLEN, /* syslog_maxlen */
98+
0, /* file_maxlen */
99+
ROOT_UID, /* mailuid */
100+
+ ROOT_GID, /* mailgid */
101+
false, /* omit_hostname */
102+
_PATH_SUDO_LOGFILE, /* logpath */
103+
"%h %e %T", /* time_fmt */
104+
@@ -151,9 +152,10 @@ eventlog_set_file_maxlen(size_t len)
105+
}
106+
107+
void
108+
-eventlog_set_mailuid(uid_t uid)
109+
+eventlog_set_mailuser(uid_t uid, gid_t gid)
110+
{
111+
evl_conf.mailuid = uid;
112+
+ evl_conf.mailgid = gid;
113+
}
114+
115+
void
116+
Index: github-sudo-CVE-2026-35535/plugins/sudoers/logging.c
117+
===================================================================
118+
--- github-sudo-CVE-2026-35535.orig/plugins/sudoers/logging.c
119+
+++ github-sudo-CVE-2026-35535/plugins/sudoers/logging.c
120+
@@ -1155,7 +1155,7 @@ init_eventlog_config(void)
121+
eventlog_set_syslog_alertpri(def_syslog_badpri);
122+
eventlog_set_syslog_maxlen(def_syslog_maxlen);
123+
eventlog_set_file_maxlen(def_loglinelen);
124+
- eventlog_set_mailuid(ROOT_UID);
125+
+ eventlog_set_mailuser(ROOT_UID, ROOT_GID);
126+
eventlog_set_omit_hostname(!def_log_host);
127+
eventlog_set_logpath(def_logfile);
128+
eventlog_set_time_fmt(def_log_year ? "%h %e %T %Y" : "%h %e %T");
129+
Index: github-sudo-CVE-2026-35535/plugins/sudoers/policy.c
130+
===================================================================
131+
--- github-sudo-CVE-2026-35535.orig/plugins/sudoers/policy.c
132+
+++ github-sudo-CVE-2026-35535/plugins/sudoers/policy.c
133+
@@ -639,7 +639,7 @@ sudoers_policy_deserialize_info(struct s
134+
}
135+
136+
#ifdef NO_ROOT_MAILER
137+
- eventlog_set_mailuid(ctx->user.uid);
138+
+ eventlog_set_mailuser(ctx->user.uid, ctx->user.gid);
139+
#endif
140+
141+
/* Dump settings and user info (XXX - plugin args) */

‎debian/patches/series‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,3 +6,4 @@ X11R6.patch
66
0007-upstream-patch-for-CVE-2025-32463.patch
77
0008-upstream-patch-for-CVE-2025-32462.patch
88
developer-mode-verify.patch
9+
cve_2026_35535.patch

0 commit comments

Comments
 (0)