CVE-2025-32463

Unknown Unknown - Not Provided

BaseFortify

Publication date: 2025-06-30

Last updated on: 2025-11-05

Assigner: MITRE

Description

Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-06-30

Last Modified

2025-11-05

Generated

2026-09-27

AI Q&A

2025-06-30

EPSS Evaluated

2026-09-26

NVD

CVE-2025-32463

Affected Vendors & Products

Vendor	Product	Version / Range
debian	debian_linux	11.0
sudo_project	sudo	From 1.9.14 (inc) to 1.9.17 (exc)
sudo_project	sudo	1.9.17
canonical	ubuntu_linux	22.04
canonical	ubuntu_linux	24.04
canonical	ubuntu_linux	24.10
canonical	ubuntu_linux	25.04
debian	debian_linux	12.0
debian	debian_linux	13.0
opensuse	leap	15.6
redhat	enterprise_linux	10.0
suse	linux_enterprise_desktop	15
suse	linux_enterprise_desktop	15
suse	linux_enterprise_real_time	15.0
suse	linux_enterprise_real_time	15.0
suse	linux_enterprise_real_time	15.0
suse	linux_enterprise_server_for_sap	12
suse	linux_enterprise_server_for_sap	12

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-829	The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.

Attack-Flow Graph

Executive Summary

CVE-2025-32463 is a vulnerability in sudo versions 1.9.14 through 1.9.17 involving the -R (--chroot) option. This option allows users to run commands with a user-specified root directory if permitted by the sudoers file. However, due to a flaw, an attacker can create a malicious /etc/nsswitch.conf file inside the user-specified root directory, causing sudo to load an arbitrary shared library. This lets the attacker execute arbitrary commands as root, even if they are not authorized in the sudoers file. The vulnerability was fixed in sudo 1.9.17p1 by reverting the problematic change and deprecating the chroot feature. [1, 2]

Detection Guidance

You can detect this vulnerability by checking if your system is running sudo versions 1.9.14 through 1.9.17 inclusive, as these versions are affected. To check the sudo version, use the command: sudo --version. Additionally, review if the sudoers file permits use of the -R or --chroot option, which is the vector for exploitation. There are no specific network detection commands provided in the resources. [1, 2]

Impact Analysis

This vulnerability allows a local attacker to escalate their privileges to root by exploiting the sudo -R (--chroot) option. Even if the attacker is not listed in the sudoers file, they can execute arbitrary commands as the root user. This can lead to full system compromise, unauthorized access, and control over the affected system. [1, 2]

Mitigation Strategies

Immediate mitigation steps include upgrading sudo to version 1.9.17p1 or later, where the vulnerability is fixed. Alternatively, disable or avoid using the -R (--chroot) option in sudo, as this feature is deprecated and planned for removal. Review and restrict sudoers file permissions to prevent unauthorized use of the chroot option. [1, 2]

Hi! I’m here to help you understand CVE-2025-32463. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70