⚠️ Overview

CVE-2025-32463 (also known as "chroot-to-root") is a critical local privilege escalation vulnerability in sudo.

It allows any local unprivileged user — even those not listed in sudoers — to gain full root access simply by using the -R / --chroot option.

The flaw was introduced in sudo 1.9.14 (June 2023) and existed until 1.9.17p1 (June 2025). It was not a traditional bug but a dangerous side-effect of how sudo handled path resolution inside a user-controlled chroot before policy checks.

Official Sudo Advisory: "An attacker can leverage sudo’s -R option to run arbitrary commands as root, even if they are not listed in the sudoers file."

🔥 Severity & Impact

• CVSS v3.1 Base Score: 9.3 / Critical
• Attack Vector: Local (no authentication, no network)
• Privileges Required: None (any local account)
• Impact: Full root access, arbitrary code execution as root

Reality Check:

• Public exploits and PoCs appeared immediately after disclosure.
• Added to CISA Known Exploited Vulnerabilities (KEV) catalog on September 29, 2025.
• Affects virtually every Linux distribution and macOS system running affected sudo versions.
• Could have been chained with other attacks for full system takeover.

🕵️ The Discoverer: Rich Mirch

• Rich Mirch — Principal Security Researcher at Stratascale Cybersecurity Research Unit (CRU).
• Reported the issue privately to sudo maintainer Todd C. Miller on April 1, 2025.
• CVE assigned April 8, 2025.
• Public analysis and full PoC released alongside disclosure on June 30, 2025.
• Also credited for related CVE-2025-32462.

🔬 Technical Deep Dive

The bug originated from a 2023 change in sudo's command-matching logic:

1. When -R /path is used, sudo calls pivot_root() before fully evaluating the sudoers policy.
2. NSS (Name Service Switch) lookups (for users/groups/PAM) then read /etc/nsswitch.conf from inside the chroot.
3. An attacker creates a fake chroot directory with:
   • A malicious /etc/nsswitch.conf (e.g., passwd: /woot1337)
   • A rogue shared library libnss_/woot1337.so.2 containing a constructor that runs as root.
4. NSS loads the attacker's library with root privileges → instant root shell.

Key Insight: The -R option was allowed even for users with no sudo permissions, making it a perfect attack vector.

📅 Timeline

🖥️ Affected Systems & Distributions

Only sudo 1.9.14 through 1.9.17 (before 1.9.17p1)

Widely Affected:

• Ubuntu 24.04 (1.9.15p5, 1.9.16p2)
• Fedora 40/41/42
• Debian 12/13 (testing)
• RHEL 9/10, AlmaLinux, Rocky Linux
• Arch Linux, openSUSE Tumbleweed
• macOS (Homebrew / MacPorts sudo)
• Almost every container image from mid-2023 to mid-2025

NOT affected:

• sudo ≤ 1.9.13 (no vulnerable chroot logic)
• sudo ≥ 1.9.17p1
• Systems where chroot feature was never enabled

💥 Public Exploit & PoC

One-liner exploit (from Stratascale CRU):

# 1 – clone repo
$ git clone https://github.com/zaryouhashraf/CVE-2025-32463
$ cd CVE-2025-32463

# 2 – build and run Docker image (tagged "sudo-chwoot")
$ sudo chmod +x CVE-2025-32463.sh
$ ./CVE-2025-32463.sh

# 3 – run exploit in container (runs root command directly or drops you into a root shell)
┌──(kali㉿kali)-[~]
└─$ ./CVE-2025-32463.sh
═══════════════════════════════════════════════════════════════
⚠  WARNING: CVE-2025-32463 EXPLOIT PoC ⚠
═══════════════════════════════════════════════════════════════
This script is for AUTHORIZED TESTING ONLY on systems you own.
Running on unauthorized systems is ILLEGAL.
Patch immediately after testing (sudo 1.9.17p1+).

[+] Creating temporary exploit stage...
[+] Compiling malicious NSS library...
[+] Triggering sudo -R ... (expect root shell)
   (If successful, you'll drop into a root bash prompt)


[!] CVE-2025-32463 triggered - gaining root...
[+] You are now root!
┌──(root㉿kali)-[/]
└─# whoami
root

🛡️ How to Check & Remediate (2026 Edition)

1. Check Your Version

sudo -V | head -n 1

✅ Safe if 1.9.17p1 or newer (or ≤ 1.9.13)

2. Update Immediately

Debian/Ubuntu:

sudo apt update && sudo apt install --reinstall sudo

Fedora/RHEL:

sudo dnf update sudo

Arch:

sudo pacman -S sudo

3. Hardening (Even After Patching)

Add to /etc/sudoers (or a file in /etc/sudoers.d/):

Defaults !use_chroot

Search for and remove any CHROOT= or runchroot= lines.

2026 Pro Tip: Scan old Docker images, CI runners, and legacy VMs — many still ship vulnerable sudo snapshots.

📈 Post-Incident Developments (2025–2026)

• Chroot feature officially deprecated and scheduled for removal in future sudo releases.
• Major distros backported patches within days.
• CISA KEV listing triggered mandatory remediation for U.S. federal systems.
• Increased scrutiny on sudo’s NSS integration and pre-policy path resolution.

🎓 Lessons Learned

• Never trust user-controlled paths before privilege checks.
• Features meant for advanced use (--chroot) can become attack surface if not isolated.
• Single-line changes in 2023 created a critical vulnerability discovered two years later.
• Public PoCs + KEV listing = rapid widespread exploitation risk.

This incident reinforced the need for principle of least privilege even in core system tools.

🔗 References & Further Reading

• NVD Official Entry
• Sudo Official Advisory
• Stratascale Full Analysis + PoC
• Oligo Security Blog (with CVE-2025-32462 context)
• CISA KEV Catalog Entry
• Red Hat Advisory
• GitHub PoC