CVE-2025-32463: Sudo Local Privilege Escalation Vulnerability

Summary

CVE-2025-32463 is a Local Privilege Escalation (LPE) vulnerability discovered in Sudo. An attacker can exploit this vulnerability to gain root privileges under certain conditions.

Vulnerability Details

• Vulnerability Description: An attacker can exploit Sudo's -R (--chroot) option to create a malicious /etc/nsswitch.conf file in a user-specified root directory. When Sudo runs in this specially crafted environment, it reads the malicious configuration, leading to the loading of an attacker-supplied library, which may result in gaining root privileges.
• Affected Software: Sudo
• Affected Versions: Sudo 1.9.14 through 1.9.17 (some sources mention a broader version range).
• Severity: Critical, with a CVSS 3.1 score of 9.3.
• Impact: An attacker who successfully exploits this vulnerability can gain full control of the system and execute arbitrary commands as root.
• Attack Prerequisites: The attacker needs a valid account on the target system.
• Solution: Update to Sudo 1.9.17p1 or later.
• Known Exploitation: Public exploit code is already available online.

How to Check

You can verify whether your system is affected by checking the Sudo version.

Method 1: Using the sudo command (Recommended)

Run the following command to check the version. This command typically does not require a password:

sudo -V

Method 2: Reading the Binary (No Privileges Required)

If you cannot or do not want to use the sudo command, you can read the version information directly from the binary using the following commands:

1. Locate the sudo path (usually /usr/bin/sudo).
2. Run the following command (replace /usr/bin/sudo with your actual path):

strings /usr/bin/sudo | grep "Sudo version"

If the reported version number is between 1.9.14 and 1.9.17 (inclusive), your system may be at risk.