Critical Sudo vulnerabilities enable local privilege escalation to root
Take action: This is a nasty flaw. If you have multiple user roles on your linux systems or are running services as non-root, make sure to update your Linux systems' Sudo utility to version 1.9.17p1 or later. The exploit vector is possible if someone already has local access to the system, which can either be through direct credentials or through breaching a vulnerable service that's running as non-root.
Learn More
The Stratascale Cyber Research Unit (CRU) is reporting two security vulnerabilities in the widely-used Sudo utility that can result in local privilege escalation to root on affected Linux systems.
The Sudo utility serves as a cornerstone of Linux security, allowing permitted users to execute commands as the superuser while maintaining an audit trail and implementing the principle of least privilege. However, the discovered vulnerabilities can completely circumvent these security controls, allowing unprivileged users to escalate their privileges to root access.
Vulnerabilities summary
- CVE-2025-32463 (CVSS score 9.3) - a critical severity local privilege escalation vulnerability via the chroot option. It allows attackers to leverage sudo's -R (--chroot) option to run arbitrary commands as root, even if they are not listed in the sudoers file. This vulnerability affects Sudo versions 1.9.14 to 1.9.17 inclusive.
- The exploit process is remarkably straightforward. An attacker can create a temporary directory structure containing a crafted nsswitch.conf file and a malicious shared library. When executing sudo with the -R option pointing to this directory, the system loads the attacker's library during NSS operations, resulting in immediate root access.
- The standard nsswitch.conf file looks like this:
passwd: files ldap group: files ldap shadow: files ldap gshadow: files ldap- When reading the nsswitch.conf file is that the name of the source is also used as part of the path for a shared object (library). For example, the above ldap source translates to libnss_ldap.so. When an NSS function uses the ldap source, the library is loaded.
- If an attacker creates their own nsswitch.conf file with something like this:
passwd: /mycode- this is translated to loading a library libnss_/mycode.so.2, which can be malicious.
- CVE-2025-32462 (CVSS score 2.8) - a local privilege escalation vulnerability via the host option. It affects sudo's host (-h or --host) option, which is intended to be used in conjunction with the list option (-l or --list) to list a user's sudo privileges on a host other than the current one. It affects Sudo versions 1.8.8 to 1.9.17 inclusive are affected, spanning over a decade of releases.
The vulnerabilities affect all Linux systems running vulnerable versions of Sudo. Exploitation of CVE-2025-32463 has been verified on Ubuntu 24.04.1 with Sudo versions 1.9.15p5 and 1.9.16p2, as well as on Fedora 41 Server with Sudo 1.9.15p5.
The bugs are fixed in sudo 1.9.17p1. Organizations should upgrade to this version or later to address both vulnerabilities.
