A flaw was found in sudo.

#!/usr/bin/env bash
# check_cve_2026_96512.sh — Detect CVE-2026-96512 (sudo TZ NOTBEFORE/NOTAFTER bypass)
# Run as root or a user who can read /etc/sudoers and /etc/sudoers.d/*
# Exit codes: 0 = PATCHED/not affected, 1 = VULNERABLE, 2 = UNKNOWN

set -euo pipefail

RESULT="UNKNOWN"

# Step 1: Check if sudo is installed
if ! command -v sudo &>/dev/null; then
  echo "PATCHED — sudo is not installed on this host."
  exit 0
fi

# Step 2: Get sudo version
SUDO_VER=$(sudo -V 2>/dev/null | head -1 | grep -oP '[0-9]+\.[0-9]+\.[0-9]+[a-z]*[0-9]*' || true)
if [[ -z "$SUDO_VER" ]]; then
  echo "UNKNOWN — could not determine sudo version."
  exit 2
fi
echo "[*] Detected sudo version: $SUDO_VER"

# Step 3: Version comparison — fixed in 1.9.16
# Extract major.minor.patch
IFS='.' read -r MAJOR MINOR PATCH_RAW <<< "$SUDO_VER"
PATCH=$(echo "$PATCH_RAW" | grep -oP '^[0-9]+' || echo "0")

VER_FIXED=0
if [[ $MAJOR -gt 1 ]]; then
  VER_FIXED=1
elif [[ $MAJOR -eq 1 && $MINOR -gt 9 ]]; then
  VER_FIXED=1
elif [[ $MAJOR -eq 1 && $MINOR -eq 9 && $PATCH -ge 16 ]]; then
  VER_FIXED=1
fi

if [[ $VER_FIXED -eq 1 ]]; then
  echo "PATCHED — sudo $SUDO_VER >= 1.9.16 (upstream fix applied)."
  exit 0
fi

# Step 4: Version is vulnerable; check if NOTBEFORE/NOTAFTER is actually in use
echo "[*] sudo version $SUDO_VER is below 1.9.16 — checking sudoers configuration..."

HITS=""
for f in /etc/sudoers /etc/sudoers.d/*; do
  [[ -r "$f" ]] || continue
  MATCH=$(grep -nE 'NOT(BEFORE|AFTER)=' "$f" 2>/dev/null || true)
  if [[ -n "$MATCH" ]]; then
    # Check if any of these lack trailing Z or timezone offset
    NO_Z=$(echo "$MATCH" | grep -vE 'NOT(BEFORE|AFTER)=[0-9]{8,14}(Z|[+-][0-9]{4})' || true)
    if [[ -n "$NO_Z" ]]; then
      HITS="${HITS}${f}:\n${NO_Z}\n"
    fi
  fi
done

if [[ -n "$HITS" ]]; then
  echo "VULNERABLE — sudo $SUDO_VER with NOTBEFORE/NOTAFTER timestamps lacking 'Z' suffix:"
  echo -e "$HITS"
  exit 1
else
  echo "PATCHED — sudo $SUDO_VER is technically vulnerable but no NOTBEFORE/NOTAFTER rules without 'Z' found. Not exploitable in current config."
  exit 0
fi