Source: Hacker News
Article note: It requires a rather atypical configuration, but... damn, that's a big edge condition oops.
Basically, in some versions of sudo, if configured with an (ALL, !root) case, trying to run something as an invalid but representable UID (-1, 4294967295) will have the underlying syscalls reject _after_ the tests, and it will then run the command as... the sudo binary's SUID 0.
Comments 
