CVE-2025-32463

Local Privilege Escalation to Root via Sudo chroot in Linux

🛑 Vulnerability Summary

CVE-2025-32463 is a local privilege escalation vulnerability in the Sudo binary. The flaw allows a local user to escalate privileges to root under specific misconfigurations or with crafted inputs. The issue was discovered by Rich Mirch.

• CVE-ID: CVE-2025-32463
• Component: sudo
• Type: Local Privilege Escalation (EoP)
• CVSS Score: TBD
• Discovered by: Rich Mirch

🔥 Impact

An attacker with low privileges can exploit this vulnerability to gain root access, compromising the system entirely.

🧪 Proof of Concept

Exploit

git clone https://github.com/kh4sh3i/CVE-2025-32463.git
cd CVE-2025-32463
chmod +x exploit.sh
id
./exploit.sh
id

🛠 Affected Versions

• Vulnerable: sudo 1.9.14 to 1.9.17
• Patched: sudo 1.9.17p1 and later
• Not affected: Legacy versions prior to 1.9.14 (chroot feature did not exist)

🛡️ Mitigation

• Update sudo to the latest patched version.
• Use security frameworks like AppArmor or SELinux to limit sudo behavior.
• Monitor for abnormal sudo invocations.

🧷 References

• CVE-2025-32463 on NVD
• Rich Mirch on Twitter
• sudo project
• stratascale

⚠️ Disclaimer

This PoC is provided for educational and research purposes only. Running this on any system without permission is illegal and unethical.