muhammedkayag/cve-2025-32463Proof-of-concept demonstrating a local privilege escalation in sudo (CVE-2025-32463) via chroot configuration manipulation, intended for defensive testing and patch verification in isolated environments.
DISCLAIMER:
This repository contains a proof-of-concept intended only for educational, defensive research, and authorized penetration testing.
Do NOT use this code on systems you do not own or do not have explicit written permission to test. Unauthorized use is illegal and may result in criminal or civil penalties. The author assumes no liability for any misuse of this material.
This PoC demonstrates a local privilege-escalation issue tracked as CVE-2025-32463. The vulnerability can allow a local, unprivileged user to obtain root privileges by influencing sudo's use of configuration or library resolution within a chroot-like environment. The code included in this repository is for verifying and hardening systems in controlled lab environments only.
sudo versions prior to 1.9.17p1 (or equivalent vendor-patched releases) are known to be vulnerable. Confirm the exact affected package names and versions with your distribution vendor/security advisory.
Isolated, offline test environment (VM or container that you own).
A build toolchain if testing PoC compilation (gcc, make) when applicable.
Familiarity with system administration, chroot concepts, and secure testing practices.
Do not run the PoC on production systems or systems you do not own.
Perform testing only in an isolated lab VM or disposable environment. Snapshot the VM before testing so you can restore it.
If you are a system owner verifying patch status, check your sudo package version and apply vendor patches rather than relying on PoC removal. Patching is the recommended remediation.
Patch immediately: install vendor-supplied updates that upgrade sudo to 1.9.17p1 or later (or the equivalent security update for your distribution).
Avoid allowing untrusted users to populate or control chroot directories used by sudo. Ensure chroot directories are owned and writable only by administrators.
Ensure system configuration files (e.g., /etc/nsswitch.conf) and shared libraries are not referenced from user-writable locations.
Apply filesystem hardening (mount options like noexec, nosuid, where appropriate) and enforce strict ownership/permissions on configuration files.
Minimize sudo privileges in sudoers and prefer least-privilege operation models.
Use integrity monitoring and log monitoring to detect anomalous sudo activity.
If you discover further issues, follow responsible disclosure practices: contact the vendor, allow reasonable time for a fix, and avoid public disclosure that enables widespread exploitation before fixes are available. When publishing PoCs, prioritize defensive guidance and avoid publishing step-by-step exploit playbooks that would enable abuse.
Contributions are welcome but must follow a defensive, non-actionable disclosure approach. Submit issues or pull requests that improve detection, mitigation, or safe testing guidance only.
chmod +x poc.sh && bash poc.sh