Summary
A flaw in sudo can cause time-based sudoers restrictions to be evaluated using a caller-controlled TZ environment variable when timestamps omit the trailing Z timezone indicator. A local user may shift the effective authorization window and run commands after or before the intended period, although this does not bypass authentication.
Affected context
The issue occurs in sudo configurations that use NOTBEFORE or NOTAFTER restrictions with timestamps lacking an explicit timezone indicator. It is relevant when sudo inherits the invoking user's TZ environment variable and uses that value while evaluating access, allowing the effective time window to differ from the administrator's intended schedule.
Exploit preconditions
- Attack surface: Local sudo authorization processing
- Required access: An authenticated local account that can invoke sudo
and influence its inherited environment
- Trigger point: Evaluation of a sudoers rule containing NOTBEFORE or
NOTAFTER timestamps without an explicit timezone suffix
- Why exploitation is possible: The setuid-root sudo process may use a
caller-controlled TZ value, allowing an extreme timezone offset to shift
the authorization window
- Scope limitation: Authentication remains required; the affected
control is the time-based authorization decision
Why this happens
The underlying bug is an improper trust-boundary decision in time interpretation. When a timestamp does not specify its timezone explicitly, sudo relies on TZ inherited from the unprivileged caller rather than a trusted, deterministic timezone context. This maps to CWE-863, Incorrect Authorization, because an attacker-controlled environmental value can alter whether an otherwise authenticated request satisfies an authorization condition.
Potential impact
- A local user may execute permitted sudo commands outside their intended time window.
- Expired or not-yet-active sudoers rules could be treated as valid.
- Administrative commands may be run outside approved operational periods.
- Security and compliance controls based on scheduled authorization may be weakened.
General mitigation guidance
Mitigation generally focuses on making authorization time evaluation
deterministic and independent of caller-controlled environment state.
Common defensive patterns include:
- Expressing authorization timestamps with an explicit timezone indicator.
- Ignoring or tightly constraining environment variables that can affect
security-sensitive parsing and policy decisions.
- Centralizing time interpretation and using a trusted, consistent timezone
policy.
- Applying least privilege so time-windowed accounts cannot perform
unnecessarily sensitive operations.
- Reviewing sudoers policies for ambiguous timestamp formats and documenting
their intended timezone semantics.
How teams detect issues like this
Organizations can identify this issue through:
- Static and configuration analysis for NOTBEFORE or NOTAFTER timestamps that
lack an explicit timezone indicator.
- Code review checks for authorization logic that consumes inherited TZ values
or other caller-controlled environment variables.
- Policy tests that evaluate access under extreme timezone offsets and around
authorization boundary times.
- Runtime auditing of sudo approvals occurring outside expected schedules.
- Automated configuration review tools and CI policy checks that enforce
explicit timezone formatting.
