From 339adaf48958b6318329ebb298195568f3d377f7 Mon Sep 17 00:00:00 2001
From: Radovan Sroka <rsroka@redhat.com>
Date: Thu, 26 Jun 2025 10:31:40 +0200
Subject: [PATCH] RHEL 8.10.0.Z ERRATUM

- CVE-2025-32462 sudo: LPE via host option
Resolves: RHEL-100014

Signed-off-by: Radovan Sroka <rsroka@redhat.com>
---
 sudo-1.9.17-CVE-2025-32462.patch | 22 ++++++++++++++++++++++
 sudo.spec                        | 10 ++++++++--
 2 files changed, 30 insertions(+), 2 deletions(-)
 create mode 100644 sudo-1.9.17-CVE-2025-32462.patch

diff --git a/sudo-1.9.17-CVE-2025-32462.patch b/sudo-1.9.17-CVE-2025-32462.patch
new file mode 100644
index 0000000..42117c6
--- /dev/null
+++ b/sudo-1.9.17-CVE-2025-32462.patch
@@ -0,0 +1,22 @@
+diff -up ./plugins/sudoers/sudoers.c.cve-host ./plugins/sudoers/sudoers.c
+--- ./plugins/sudoers/sudoers.c.cve-host	2025-06-25 14:10:11.369219892 +0200
++++ ./plugins/sudoers/sudoers.c	2025-06-25 14:11:48.395137626 +0200
+@@ -393,6 +393,18 @@ sudoers_policy_main(int argc, char * con
+ 	}
+     }
+ 
++    /* The user may only specify a host for "sudo -l". */
++    if (!ISSET(sudo_mode, MODE_LIST|MODE_CHECK)) {
++       if (strcmp(user_runhost, user_host) != 0) {
++           log_warningx(SLOG_NO_STDERR|SLOG_AUDIT,
++               N_("user not allowed to set remote host for command"));
++           sudo_warnx("%s",
++               U_("a remote host may only be specified when listing privileges."));
++           ret = false;
++           goto done;
++       }
++    }
++
+     /* If given the -P option, set the "preserve_groups" flag. */
+     if (ISSET(sudo_mode, MODE_PRESERVE_GROUPS))
+ 	def_preserve_groups = true;
diff --git a/sudo.spec b/sudo.spec
index c6ee998..6ebea47 100644
--- a/sudo.spec
+++ b/sudo.spec
@@ -1,7 +1,7 @@
 Summary: Allows restricted root access for specified users
 Name: sudo
 Version: 1.9.5p2
-Release: 1%{?dist}
+Release: 1%{?dist}.1
 License: ISC
 Group: Applications/System
 URL: https://www.sudo.ws/
@@ -52,6 +52,7 @@ Patch17: sudo-1.9.13-CVE-2023-28486-7-9.patch
 Patch18: linker.patch
 
 Patch19: sudo-1.9.15-CVE-2023-42465.patch
+Patch20: sudo-1.9.17-CVE-2025-32462.patch
 
 %description
 Sudo (superuser do) allows a system administrator to give certain
@@ -95,8 +96,8 @@ plugins that use %{name}.
 %patch -P 17 -p1 -b .cve-escape-9
 
 %patch -P 18 -p1 -b .linker
-
 %patch -P 19 -p1 -b .rowhammer
+%patch -P 20 -p1 -b .cve-host
 
 %build
 # Remove bundled copy of zlib
@@ -272,6 +273,11 @@ rm -rf $RPM_BUILD_ROOT
 %{_mandir}/man8/sudo_plugin.8*
 
 %changelog
+* Wed Jun 25 2025 Radovan Sroka <rsroka@redhat.com> - 1.9.5p2-10.1
+RHEL 8.10.0.Z ERRATUM
+- CVE-2025-32462 sudo: LPE via host option
+Resolves: RHEL-100014
+
 * Mon Jan 22 2024 Radovan Sroka <rsroka@redhat.com> - 1.9.5p2-1
 RHEL 8.9.0.Z ERRATUM
 - Rebase to 1.9.5p2