CVE-2026-96512: 
Rocky Linux vulnerability analysis and mitigation

CVE-2026-96512 is a time-based authorization bypass vulnerability in sudo, classified as Incorrect Authorization (CWE-863). When sudoers rules use NOTBEFORE or NOTAFTER timestamps that omit the trailing 'Z' UTC timezone indicator, sudo's parse_gentime() function uses mktime() — which respects the process's TZ environment variable — instead of timegm(). Because sudo is a setuid-root program that inherits the caller's environment, an unprivileged local user can set TZ to an extreme POSIX offset (e.g., TZ=XXX24) to shift the time evaluation window by up to ~25 hours, causing expired rules to be treated as valid. The vulnerability affects sudo versions 1.8.20 through 1.9.17p2 and was publicly disclosed on September 23, 2026. It carries a CVSS v3.1 base score of 7.8 (High) (Red Hat CVE, Github Advisory).

The root cause lies in plugins/sudoers/gentime.c, where the parse_gentime() function calls mktime() to interpret timestamps lacking a 'Z' suffix. Since mktime() re-reads the TZ environment variable each time it is called, and sudo inherits the unprivileged caller's environment as a setuid-root binary, an attacker can manipulate TZ to shift time interpretation by up to ~25 hours in either direction. The upstream fix (commit 1820a349) addresses this by making a separate copy of environ[] in os_init_common() and then calling unsetenv("TZ") followed by tzset() early in startup, ensuring the system timezone is used for all subsequent time evaluations without modifying the original envp passed to plugins. Exploitation requires that the attacker already be the subject of a sudoers rule using NOTBEFORE/NOTAFTER with a timezone-naive timestamp — a non-default configuration (Red Hat Bugzilla, sudo commit).

Successful exploitation allows an unprivileged local user to execute commands as root (or any sudoers-authorized user) outside the intended time window defined by NOTBEFORE/NOTAFTER rules, resulting in high confidentiality, integrity, and availability impact. The attacker can read sensitive files, modify system data, or execute arbitrary privileged commands — effectively gaining full control of the affected system within the scope of the sudoers rule. PAM authentication is not bypassed; the attacker cannot gain access beyond what the sudoers rule already grants, but the time-based restriction is completely defeated. This vulnerability can serve as an escalation step in a multi-stage attack chain, enabling lateral movement or persistence after an initial local foothold (Red Hat CVE, Github Advisory).

A public proof-of-concept (PoC) exploit named "SudoTimeWarp" is available on GitHub, consisting of runnable shell scripts (poc.sh, repro-admin.sh, repro-attacker.sh) and a Dockerfile that reproduce the vulnerability locally. The PoC was published on September 25, 2026, and is assessed with high confidence as a real, functional exploit. No in-the-wild exploitation has been confirmed as of the time of this report. The EPSS score is approximately 0.13%, indicating a currently low but non-negligible probability of exploitation in the next 30 days. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a local foothold and a sudoers configuration using timezone-naive NOTBEFORE/NOTAFTER timestamps, limiting the attack surface to systems with this non-default configuration (PoC GitHub, Red Hat Bugzilla).

1. Reconnaissance: Identify target Linux systems running sudo versions 1.8.20–1.9.17p2 where the attacker already has a local unprivileged account that is subject to a sudoers rule using NOTBEFORE or NOTAFTER timestamps without a trailing 'Z'.
2. Verify sudoers configuration: As the unprivileged user, attempt sudo -l to enumerate applicable rules and confirm the presence of time-restricted entries (e.g., NOTAFTER=20261231235959 without Z).
3. Determine the expired time window: Calculate the current UTC time and identify how far in the past the NOTAFTER timestamp has expired (up to ~25 hours is exploitable).
4. Set TZ to an extreme offset: Export an extreme POSIX timezone offset to shift sudo's time evaluation window. For example, set TZ=XXX24 (which represents UTC-24, effectively adding 24 hours to the perceived current time): export TZ=XXX24.
5. Execute the restricted command: Run the sudo command that would normally be denied due to the expired time window: sudo -n /usr/bin/id (or any command permitted by the rule). Because mktime() now interprets the zone-less NOTAFTER timestamp in the attacker's manipulated timezone, the expired rule appears valid.
6. Confirm privilege escalation: Verify the command executed as root (e.g., output shows uid=0(root)). Replace /usr/bin/id with any command of choice (e.g., spawning a shell: sudo /bin/bash) to achieve full privilege escalation.
7. Chain for persistence: Use the elevated privileges to install backdoors, add SSH keys, create new privileged accounts, or perform lateral movement (PoC GitHub, Red Hat Bugzilla).

• Logs: Entries in /var/log/auth.log or /var/log/secure showing a user successfully invoking sudo at an unusual time (outside their expected working hours), particularly for commands governed by NOTBEFORE/NOTAFTER rules; sudo audit logs recording commands executed with TZ set to an extreme value.
• Process: Unexpected privileged processes (e.g., /bin/bash, id, whoami) spawned by sudo as uid=0 from an unprivileged user account at off-hours; child processes of sudo with environment variables containing extreme TZ values (e.g., TZ=XXX24).
• File System: New files or modified configurations in /root/, /etc/cron.d/, /etc/sudoers.d/, or ~/.ssh/authorized_keys created by or attributed to an unprivileged user account; unexpected setuid binaries or scripts added to the system.
• Network: Outbound connections from the compromised host to unknown external IPs initiated by processes running as root, shortly after a sudo invocation by an unprivileged user.
• Configuration: Sudoers rules containing NOTBEFORE or NOTAFTER timestamps without a trailing 'Z' suffix, identifiable via: grep -rE 'NOT(BEFORE|AFTER)=' /etc/sudoers /etc/sudoers.d/ (Red Hat CVE).

Patch: Update sudo to a fixed version. Red Hat has released patches for affected RHEL versions: RHEL 8 via sudo-1.9.5p2-2.el8_10 (RHSA-2026:75580), RHEL 9 via sudo-1.9.17p2-3.el9_8.3 (RHSA-2026:75571), and RHEL 10 via sudo-1.9.17-10.p2.el10_2.7 (RHSA-2026:75579). The upstream fix is commit 1820a349 in the sudo-project repository. Workaround: Append the 'Z' timezone suffix to all NOTBEFORE and NOTAFTER timestamps in sudoers rules (e.g., change NOTAFTER=20261231235959 to NOTAFTER=20261231235959Z); timestamps with 'Z' are interpreted via timegm() and are immune to TZ manipulation. Audit existing sudoers configurations with: grep -rE 'NOT(BEFORE|AFTER)=' /etc/sudoers /etc/sudoers.d/ and verify all timestamps end with 'Z' (Red Hat CVE, Red Hat Bugzilla).

The vulnerability was reported by independent security researcher Ermenson Junior on 2026-08-28 and acknowledged by upstream sudo maintainer Todd Miller, who committed the fix on 2026-08-29. Red Hat rated the issue as "Important" severity and issued errata for RHEL 8, 9, and 10 within approximately two weeks of public disclosure. Security news outlets including GBHackers, CyberSecurityNews, SecurityOnline, and The Hacker News (weekly recap) covered the vulnerability, highlighting the TZ manipulation technique as a novel privilege escalation vector. Community discussion on Mastodon (infosec.exchange) and LinkedIn noted the practical impact is limited to non-default sudoers configurations, but emphasized the risk in enterprise environments with time-windowed access controls (Red Hat CVE, oss-sec).