“We developed three different exploits for this vulnerability, and obtained full root privileges on Ubuntu 20.04 (Sudo 1.8.31), Debian 10 (Sudo 1.8.27), and Fedora 33 (Sudo 1.9.2).”
Any local user could become root without knowing a password, in sudo’s default configuration. The bug went in with a commit in July 2011. It sat there for nearly ten years in one of the most-used programs on Linux. The tool everyone trusts to guard root was the way in.