CVE-2025-32463

Local Privilege Escalation to Root via Sudo chroot in Linux.

What's This?

For the news, you can read here:

• https://www.helpnetsecurity.com/2025/07/01/sudo-local-privilege-escalation-vulnerabilities-fixed-cve-2025-32462-cve-2025-32463/

TL;DR and CMIIW So, sudo is a command to run a command as admin/root. A user can run sudo if they are in the sudoers group. But there is a bug in the sudo binary that allows a regular user without permission to run sudo, switching user to root.

The bug is a vulnerability in the sudo --chroot command option. This chroot allows running a command in a temporary directory. The problem is that sudo will check the configuration file inside that temporary directory, before checking whether the user is allowed to run sudo or not.

If this configuration file can somehow be edited and point to a modified code to gain root access, we can get root access without authentication or being registered as a sudoer. Because in the process, to obtain that information, the system will escalate the command as root (temporarily).

What is that config file? /etc/nsswitch.conf. This config file is used by the system to know, for example, which group this user belongs to, etc. Inside the nsswitch file, it looks something like this:

<database> <source1> <source2> ... <sourcen>

passwd  files systemd
group   files systemd
shadow  files
gshadow files
...

Now! If the data source used is files, nss will call a library named libnss_files.so.2. This file contains C code, and if we edit it, it's highly likely we can gain root access. Because the system runs this as root even though the command is not run by a sudoer. This can be seen in the exploit.sh file.

In summary:

• create a fake config file, i.e. /etc/nsswitch.conf in a folder we control.
• use chroot to point sudo to that folder.
• make sudo load a library that has been injected with code to gain root access.

POC