CVE-2025-32463

Sudo before 1.9.17p1 mishandles the --chroot option: when sudo runs chrooted, it loads /etc/nsswitch.conf from the user-controlled chroot directory rather than the trusted system copy. A local user who can invoke sudo with --chroot can plant a crafted nsswitch.conf (and the NSS libraries it references) in that directory, causing sudo to load untrusted functionality as root. Successful exploitation grants full root privileges on the host, and any Linux deployment running an unpatched sudo is affected, including Ubuntu, Debian, Red Hat Enterprise Linux, SUSE and openSUSE products per the CPE data. The vulnerability is confirmed exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2025-09-29 (ransomware association not yet reported), and EPSS assigns a high 59.4% probability of exploitation within 30 days. Public proof-of-concept references are already available from the researchers who disclosed the flaw.

What to do: Upgrade Sudo to 1.9.17p1 or later, or apply your distribution's updated sudo packages (Ubuntu, Debian, Red Hat Enterprise Linux, SUSE and openSUSE have issued patches); the same update also fixes the related local privilege escalation CVE-2025-32462. Until patched, remove or restrict the -R/--chroot option in sudoers policies and identify local users permitted to run sudo with chroot, and audit installed sudo versions across servers and container images. Federal agencies must satisfy the CISA KEV required action, including applicable BOD 22-01 guidance for cloud services.