ubuntu 20.04.6 sudo 源码包在线升级到1.9.17p1

ubuntu 20.04.6 sudo 源码包在线升级到1.9.17p1

前提：Linux sudo 本地提权漏洞(CVE-2025-32462、CVE-2025-32463)安全风险通告

升级版本 sudo >= 1.9.17p1

原文章

https://ti.qianxin.com/vulnerability/notice-detail/1455?type=risk

1.下载sudo 源码包

https://www.sudo.ws/sudo/dist/ 里面查看需要的版本或者最新版本，

本次使用最新版本

https://www.sudo.ws/sudo/dist/sudo-1.9.17p1.tar.gz

原始版本：cat /etc/os-release NAME="Ubuntu"
VERSION="20.04.6 LTS (Focal Fossa)"
ID=ubuntu
ID_LIKE=debian
PRETTY_NAME="Ubuntu 20.04.6 LTS"
VERSION_ID="20.04"
HOME_URL="https://www.ubuntu.com/"
SUPPORT_URL="https://help.ubuntu.com/"
BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
VERSION_CODENAME=focal
UBUNTU_CODENAME=focalroot@dfmc-dpca-ai:~# sudo -V
Sudo version 1.8.31
Configure options: --build=x86_64-linux-gnu --prefix=/usr --includedir=${prefix}/include --mandir=${prefix}/share/man --infodir=${prefix}/share/info --sysconfdir=/etc --localstatedir=/var --disable-silent-rules --libdir=${prefix}/lib/x86_64-linux-gnu --libexecdir=${prefix}/lib/x86_64-linux-gnu --disable-maintainer-mode --disable-dependency-tracking -v --with-all-insults --with-pam --with-fqdn --with-logging=syslog --with-logfac=authpriv --with-env-editor --with-editor=/usr/bin/editor --with-exampledir=/usr/share/doc/sudo/examples --with-timeout=15 --with-password-timeout=0 --with-passprompt=[sudo] password for %p:  --without-lecture --with-tty-tickets --disable-root-mailer --enable-admin-flag --with-sendmail=/usr/sbin/sendmail --with-rundir=/run/sudo --libexecdir=/usr/lib --with-sssd --with-sssd-lib=/usr/lib/x86_64-linux-gnu --with-selinux --with-linux-audit --enable-tmpfiles.d=yes
Sudoers policy plugin version 1.8.31
Sudoers file grammar version 46

mkdir /soft
cd /soft
wget https://www.sudo.ws/sudo/dist/sudo-1.9.17p1.tar.gz --no-check-certificate

2.编译安装

root@dfmc-dpca-ai:/soft#  tar -xzf sudo-1.9.17p1.tar.gz
root@dfmc-dpca-ai:/soft# cd sudo-1.9.17p1/
root@dfmc-dpca-ai:/soft/sudo-1.9.17p1# ./configure
root@dfmc-dpca-ai:/soft/sudo-1.9.17p1# make 
root@dfmc-dpca-ai:/soft/sudo-1.9.17p1# make install 

3.验证

bash 是新开一个bash界面，是为了验证编译结果是否生效

root@dfmc-dpca-ai:/soft/sudo-1.9.17p1# bash
root@dfmc-dpca-ai:/soft/sudo-1.9.17p1# cd
root@dfmc-dpca-ai:~# sudo -V
Sudo version 1.9.17p1
Configure options: 
Sudoers policy plugin version 1.9.17p1
Sudoers file grammar version 50Sudoers path: /etc/sudoers
Authentication methods: 'passwd'