CVE-2025-32463 - sudo chroot

Usage

The Dockerfile creates a safe, isolated testing environment with a vulnerable version of sudo (1.9.16p2) installed. This allows you to test the exploit without affecting your host system.

# Build the vulnerable test environment
docker build -t cve .

# Run the container (creates an unprivileged user 'testuser')
docker run -it cve

# Execute the proof-of-concept exploit
./poc.sh

After running poc.sh, you should obtain a root shell within the container, demonstrating the privilege escalation vulnerability.

Introduction

The vulnerability is a local privilege escalation that involves the Sudo chroot feature. Exploitation does not require any sudo rules to be defined for the user. As such, any local user could potentially escalate to root if a vulnerable version of sudo is installed.

Vulnerability Details

CVE Information

• CVE ID: CVE-2025-32463
• CVSS 3.1 Score: 9.3 (Critical)
• Vulnerability Type: Local Privilege Escalation
• Attack Vector: Local
• Attack Complexity: Low
• Privileges Required: Low
• User Interaction: None
• Disclosure Date: July 2025
• CISA KEV Status: Added to Known Exploited Vulnerabilities catalog (September 2025)

Overview

CVE-2025-32463 is a critical privilege escalation vulnerability in sudo's chroot feature (-R or --chroot option). The vulnerability allows an unprivileged local user to escalate to root without requiring any sudo permissions to be configured.

Technical Details

The vulnerability exploits a race condition in how sudo handles Name Service Switch (NSS) libraries when using the -R chroot option. When sudo performs a chroot operation:

1. Sudo changes the root directory to the user-specified path
2. Before dropping privileges, sudo performs user/group lookups via NSS
3. NSS loads shared libraries (libnss_*.so) based on /etc/nsswitch.conf
4. If the attacker controls the chroot environment, they can place a malicious NSS library that gets loaded with elevated privileges

Attack Flow

The proof-of-concept exploit works as follows:

1. Creates a temporary staging directory
2. Compiles a malicious NSS shared library with a constructor that:
   • Sets UID/GID to 0 (root)
   • Spawns a root shell
3. Sets up a fake chroot environment with a malicious nsswitch.conf that redirects lookups to the attacker's NSS library
4. Executes sudo -R <chroot_path> /bin/true
5. Sudo loads the malicious NSS library with root privileges before dropping permissions
6. The constructor function executes, granting a root shell

Prerequisites

• Local access to a system with vulnerable sudo installed
• No sudo permissions required for the user
• Ability to compile C code (gcc)
• Write access to /tmp or another directory

Impact

• Complete system compromise (root access)
• No authentication or sudo rules required
• Any local user can exploit

Affected Versions

• Stable 1.9.14 - 1.9.17

Note: Sudo versions <=1.8.32 are not vulnerable because the chroot feature does not exist

Mitigation

Patching

Upgrade to sudo version 1.9.17p1 or later, which includes a fix for this vulnerability.

Workarounds (if patching is not immediately possible)

• Disable or restrict access to sudo's chroot feature
• Monitor for suspicious usage of sudo -R command
• Implement additional access controls for local users

Detection

Monitor system logs for:

• Usage of sudo -R command by unprivileged users
• Compilation of shared libraries in /tmp directories
• Suspicious NSS library loads

Disclaimer

This proof-of-concept is provided for educational and authorized security testing purposes only. Only use this exploit on systems you own or have explicit written permission to test. Unauthorized access to computer systems is illegal.

Acknowledgement

The CVE-2025-32463 Sudo chroot Elevation of Privilege Vulnerability was discovered by Rich Mirch of the Stratascale Cyber Research Unit. All the credit for the research and POC goes to him. Show some support and read the research here: https://www.stratascale.com/vulnerability-alert-CVE-2025-32463-sudo-chroot