CVE-2022-42717 Privilege escalation in n/a

High 7.8 Published 11 Oct 2022 Updated 20 May 2025

Non-privileged users can execute arbitrary commands as root if the host uses the insecure recommended sudoers configuration for Vagrant.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2022-42717?

CVE-2022-42717 is a high-severity vulnerability in n/a, published on 11 Oct 2022. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

An issue was discovered in Hashicorp Packer before 2.3.1. The recommended sudoers configuration for Vagrant on Linux is insecure. If the host has been configured according to this documentation, non-privileged users on the host can leverage a wildcard in the sudoers configuration to execute arbitrary commands as root.

Weakness: CWE-284

Which versions are affected by CVE-2022-42717?

It affects 1 product.

Products include Hashicorp Vagrant.

How do I fix CVE-2022-42717?

Change a configuration setting.

Is CVE-2022-42717 being exploited?

There is no known exploitation of CVE-2022-42717 in the wild and no public exploit code.

Sources

Also known as AZL-11115, GHSA-mc87-5qgf-5qvj, UBUNTU-CVE-2022-42717.