Linux Users Urged to Patch Critical Sudo CVE
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-32463 | Local Privilege Escalation to Root in Sudo via Untrusted nsswitch.conf with --chroot Sudo before 1.9.17p1 mishandles the --chroot option: when sudo runs chrooted, it loads /etc/nsswitch.conf from the user-controlled chroot directory rather than the trusted system copy. A local user who can invoke sudo with --chroot can plant a crafted nsswitch.conf (and the NSS libraries it references) in that directory, causing sudo to load untrusted functionality as root. Successful exploitation grants full root privileges on the host, and any Linux deployment running an unpatched sudo is affected, including Ubuntu, Debian, Red Hat Enterprise Linux, SUSE and openSUSE products per the CPE data. The vulnerability is confirmed exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2025-09-29 (ransomware association not yet reported), and EPSS assigns a high 59.4% probability of exploitation within 30 days. Public proof-of-concept references are already available from the researchers who disclosed the flaw. Do: Upgrade Sudo to 1.9.17p1 or later, or apply your distribution's updated sudo packages (Ubuntu, Debian, Red Hat Enterprise Linux, SUSE and openSUSE have issued patches); the same update also fixes the related local privilege escalation CVE-2025-32462. Until patched, remove or restrict the -R/--chroot option in sudoers policies and identify local users permitted to run sudo with chroot, and audit installed sudo versions across servers and container images. Federal agencies must satisfy the CISA KEV required action, including applicable BOD 22-01 guidance for cloud services. | 7.8 | 59% | KEV PoC ×2 |
| masshundreds of millions of Linux hosts (sudo is installed by default on virtually every Ubuntu, Debian, RHEL, SUSE and openSUSE server, desktop and container… |
Full article443 words · extracted from infosecurity-magazine.com · click to collapse
Security researchers have discovered a critical elevation of privilege (EoP) vulnerability in a popular Linux utility, and another that has been lying hidden for over a decade.
Sudo is a privileged command-line tool installed on 99% of Linux servers and workstations, which means around 30-50 million endpoints in the US alone, according to security vendor Stratascale.
The utility is often used to implement least privilege access by delegating admin tasks that require elevated privileges without sharing the root password, and also creating an audit trail in the system log, Stratascale explained.
However, CVE-2025-32463 undermines this by enabling local users to gain full root access to a targeted system, via abuse of the chroot function.
“The issue arises from allowing an unprivileged user to invoke chroot() on a writable, untrusted path under their control. Sudo calls chroot() several times, regardless of whether the user has corresponding Sudo rule configured,” Stratascale explained.
“Allowing a low-privileged user the ability to call chroot() with root authority to a writable location can have various security risks.”
The issue, which was introduced in June 2023, affects Sudo versions 1.9.14 - 1.9.17, and has been verified on Ubuntu 24.04.1 and Fedora 41 Server. Sudo users are urged to install Sudo 1.9.17p1 or later to fix the critical vulnerability.
The same security vendor found a second EoP bug in Sudo versions Stable 1.9.0 - 1.9.17 and Legacy 1.8.8 - 1.8.32.
Remarkably, it has gone unnoticed for 12 years, having been introduced when the “host” option was implemented in the Sudo code. No exploit is needed to elevate privileges in this case.
“The issue can only be leveraged with specific configurations using the Host or Host_Alias directives, which are commonly used in enterprise environments,” Stratascale warned.
Although it’s classed only as a low-severity bug, users are urged to update to Sudo 1.9.17p1 or later to mitigate the issue.
“It’s important to understand that long-undetected vulnerabilities like this highlight critical gaps in visibility across digital infrastructures. These exposures aren’t just technical failures, they are operational risks that can undermine trust, identity and compliance,” argued Stratascale principal consultant, Rich Mirch.
“Business leaders must prioritize an immediate audit of their environment to identify where similar blind spots exist, ensure teams have the detection capabilities and response processes to avoid repeat scenarios and patch all vulnerable systems.”
Organizations should focus first on shared environments and systems in untrusted locations like internet-facing assets, he concluded.
“This vulnerability serves as a call to reassess how effectively your security investments are surfacing latent risks. If this one went undetected, it’s likely others have too,” said Mirch.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/linux-users-urged-to-patch/