ubuntu 20.04.6 sudo 源码包在线升级到1.9.17p1
前提：Linux sudo 本地提权漏洞(CVE-2025-32462、CVE-2025-32463)安全风险通告
升级版本 sudo >= 1.9.17p1
原文章
https://ti.qianxin.com/vulnerability/notice-detail/1455?type=risk
1.下载sudo 源码包
https://www.sudo.ws/sudo/dist/ 里面查看需要的版本或者最新版本，
本次使用最新版本
https://www.sudo.ws/sudo/dist/sudo-1.9.17p1.tar.gz
原始版本：
cat /etc/os-release
NAME="Ubuntu"
VERSION="20.04.6 LTS (Focal Fossa)"
ID=ubuntu
ID_LIKE=debian
PRETTY_NAME="Ubuntu 20.04.6 LTS"
VERSION_ID="20.04"
HOME_URL="https://www.ubuntu.com/"
SUPPORT_URL="https://help.ubuntu.com/"
BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
VERSION_CODENAME=focal
UBUNTU_CODENAME=focal
root@dfmc-dpca-ai:~# sudo -V
Sudo version 1.8.31
Configure options: --build=x86_64-linux-gnu --prefix=/usr --includedir=${prefix}/include --mandir=${prefix}/share/man --infodir=${prefix}/share/info --sysconfdir=/etc --localstatedir=/var --disable-silent-rules --libdir=${prefix}/lib/x86_64-linux-gnu --libexecdir=${prefix}/lib/x86_64-linux-gnu --disable-maintainer-mode --disable-dependency-tracking -v --with-all-insults --with-pam --with-fqdn --with-logging=syslog --with-logfac=authpriv --with-env-editor --with-editor=/usr/bin/editor --with-exampledir=/usr/share/doc/sudo/examples --with-timeout=15 --with-password-timeout=0 --with-passprompt=[sudo] password for %p: --without-lecture --with-tty-tickets --disable-root-mailer --enable-admin-flag --with-sendmail=/usr/sbin/sendmail --with-rundir=/run/sudo --libexecdir=/usr/lib --with-sssd --with-sssd-lib=/usr/lib/x86_64-linux-gnu --with-selinux --with-linux-audit --enable-tmpfiles.d=yes
Sudoers policy plugin version 1.8.31
Sudoers file grammar version 46
mkdir /soft
cd /soft
wget https://www.sudo.ws/sudo/dist/sudo-1.9.17p1.tar.gz --no-check-certificate
2.编译安装
root@dfmc-dpca-ai:/soft# tar -xzf sudo-1.9.17p1.tar.gz
root@dfmc-dpca-ai:/soft# cd sudo-1.9.17p1/
root@dfmc-dpca-ai:/soft/sudo-1.9.17p1# ./configure
root@dfmc-dpca-ai:/soft/sudo-1.9.17p1# make
root@dfmc-dpca-ai:/soft/sudo-1.9.17p1# make install
3.验证
bash 是新开一个bash界面，是为了验证编译结果是否生效
root@dfmc-dpca-ai:/soft/sudo-1.9.17p1# bash
root@dfmc-dpca-ai:/soft/sudo-1.9.17p1# cd
root@dfmc-dpca-ai:~# sudo -V
Sudo version 1.9.17p1
Configure options:
Sudoers policy plugin version 1.9.17p1
Sudoers file grammar version 50
Sudoers path: /etc/sudoers
Authentication methods: 'passwd'