CVE-2025-32463
published 2025-06-30CVE-2025-32463: Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option.
PriorityP184high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
KEVITWEXPLOITInitial access
CISA Known Exploited Vulnerabilitydue 2025-10-20
Exploited in the wild
EPSS
55.50%
99.0th percentile
Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option.
Affected
23 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | sudo | < sudo 1.9.16p2-3 (forky) | sudo 1.9.16p2-3 (forky) |
| msrc | azl3_sudo_1.9.17-1_on_azure_linux_3.0 | — | — |
| msrc | cbl2_sudo_1.9.17-1_on_cbl_mariner_2.0 | — | — |
| msrc | cm2_sudo_1.9.17-1_on_cbl_mariner_2.0 | — | — |
| opensuse | leap | — | — |
| redhat | enterprise_linux | — | — |
| sudo_project | sudo | — | — |
| sudo_project | sudo | >= 0 < 1.9.16p2-3 | 1.9.16p2-3 |
| sudo_project | sudo | >= 0 < 1.9.16p2-3 | 1.9.16p2-3 |
| sudo_project | sudo | >= 0 < 1.9.9-1ubuntu2.5 | 1.9.9-1ubuntu2.5 |
| sudo_project | sudo | >= 0 < 1.9.15p5-3ubuntu5.24.04.1 | 1.9.15p5-3ubuntu5.24.04.1 |
| sudo_project | sudo | >= 1.9.14 < 1.9.17p1 | 1.9.17p1 |
| sudo_project | sudo | >= 1.9.14 < 1.9.17 | 1.9.17 |
| suse | linux_enterprise_desktop | — | — |
| suse | linux_enterprise_real_time | — | — |
| suse | linux_enterprise_server_for_sap | — | — |
Detection & IOCsextracted from sources · hover to see the quote
sigma↗
detection: sudo process with -R or --chroot argument invoked by non-root user
- →Monitor for sudo process invocations containing the -R or --chroot flag, especially by users not present in the sudoers file. ↗
- →Alert on creation of /etc/nsswitch.conf inside user-writable or temporary directories (e.g. under /tmp), which is a prerequisite for exploitation. ↗
- →Detect creation of shared libraries (*.so.*) in temporary or user-controlled directories, particularly those matching the libnss_ naming pattern, which are used to deliver the malicious NSS module. ↗
- →Look for sudo error output matching the pattern 'woot.*no such file or directory' as a canary for exploit probing (used in the Nuclei detection template). ↗
- →Detect calls to setreuid(0,0) / setregid(0,0) followed by chdir('/') and execl('/bin/bash') originating from a shared library constructor (__attribute__((constructor))), indicative of the PoC payload. ↗
- →Audit systems running sudo versions 1.9.14 through 1.9.17 (inclusive); these are the exclusively affected versions. Patch to 1.9.17p1 or later. ↗
- →Flag Metasploit module activity for the module path linux/local/sudo_chroot_cve_2025_32463 as an indicator of automated exploitation attempts. ↗
- ·The vulnerability only affects sudo versions 1.9.14 through 1.9.17 inclusive; RHEL 9 and earlier (which ship older sudo versions) are NOT affected. ↗
- ·Exploitation does NOT require the attacker to be listed in the sudoers file — the default sudo configuration is vulnerable, making this broadly exploitable on affected versions. ↗
- ·The -R (--chroot) feature has been deprecated in 1.9.17p1 and will be removed entirely in a future sudo release; blocking or auditing its use is a viable compensating control. ↗
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv8.8HIGH
vulncheck9.3CRITICAL
cisa7.8HIGH
vendor_debian9.3LOW
vendor_msrc9.3CRITICAL
vendor_redhat9.3CRITICAL
vendor_ubuntu2.8LOW
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA
Sudo Inclusion of Functionality from Untrusted Control Sphere Vulnerability
cisa·2025-09-29·CVSS 7.8
CVE-2025-32463 [HIGH] CWE-829 Sudo Inclusion of Functionality from Untrusted Control Sphere Vulnerability
Vulnerability: Sudo Inclusion of Functionality from Untrusted Control Sphere Vulnerability
Affected: Sudo Sudo
Sudo contains an inclusion of functionality from untrusted control sphere vulnerability. This vulnerability could allow local attacker to leverage sudo’s -R (--chroot) option to run arbitrary commands as root, even if they are not listed in the sudoers file.
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Notes: This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://www.sudo.ws/security/advisories/ch
Red Hat
sudo: LPE via chroot option
vendor_redhat·2025-06-30·CVSS 9.3
CVE-2025-32463 [CRITICAL] CWE-427 sudo: LPE via chroot option
sudo: LPE via chroot option
Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option.
A flaw was found in Sudo. This flaw allows a local attacker to escalate their privileges by tricking Sudo into loading an arbitrary shared library using the user-specified root directory via the `-R` (`--chroot`) option. An attacker can run arbitrary commands as root on systems that support `/etc/nsswitch.conf`.
Statement: The severity of this vulnerability is rated as Important due to the requirement that an attacker must have access to a valid account on a system and that it allows a local unprivileged attacker to escalate their privileges even if the account is not listed in the sudoers file.
Due to the
Ubuntu
Sudo vulnerabilities
vendor_ubuntu·2025-06-30·CVSS 2.8
CVE-2025-32463 [LOW] Sudo vulnerabilities
Title: Sudo vulnerabilities
Summary: Several security issues were fixed in Sudo.
Rich Mirch discovered that Sudo incorrectly handled the host option. In
environments where per-host rules are configured in the sudoers file, a
local attacker could use this issue to bypass the host restrictions.
(CVE-2025-32462)
Rich Mirch discovered that Sudo incorrectly handled the chroot option. In
environments where the sudoers file is configured to allow the chroot
option, a local attacker could use this issue to run arbitrary commands as
root. This issue only applied to Ubuntu 24.04 LTS, Ubuntu 24.10, and
Ubuntu 25.04. (CVE-2025-32463)
Instructions: In general, a standard system update will make all the necessary changes.
Microsoft
Sudo before 1.9.17p1 allows local users to obtain root access
vendor_msrc·2025-06-10·CVSS 9.3
CVE-2025-32463 [CRITICAL] CWE-829 Sudo before 1.9.17p1 allows local users to obtain root access
Sudo before 1.9.17p1 allows local users to obtain root access
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
mitre: mitre
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https:/
Debian
CVE-2025-32463: sudo - Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswi...
vendor_debian·2025·CVSS 9.3
CVE-2025-32463 [CRITICAL] CVE-2025-32463: sudo - Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswi...
Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved (fixed in 1.9.16p2-3)
sid: resolved (fixed in 1.9.16p2-3)
trixie: resolved (fixed in 1.9.16p2-3)
OSV
sudo vulnerabilities
osv·2025-06-30·CVSS 8.8
CVE-2025-32462 [HIGH] sudo vulnerabilities
sudo vulnerabilities
Rich Mirch discovered that Sudo incorrectly handled the host option. In
environments where per-host rules are configured in the sudoers file, a
local attacker could use this issue to bypass the host restrictions.
(CVE-2025-32462)
Rich Mirch discovered that Sudo incorrectly handled the chroot option. In
environments where the sudoers file is configured to allow the chroot
option, a local attacker could use this issue to run arbitrary commands as
root. This issue only applied to Ubuntu 24.04 LTS, Ubuntu 24.10, and
Ubuntu 25.04. (CVE-2025-32463)
GHSA
GHSA-695j-c63m-mvxc: Sudo before 1
ghsa_unreviewed·2025-06-30
CVE-2025-32463 [CRITICAL] CWE-829 GHSA-695j-c63m-mvxc: Sudo before 1
Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option.
OSV
CVE-2025-32463: Sudo before 1
osv·2025-06-30·CVSS 7.8
CVE-2025-32463 [HIGH] CVE-2025-32463: Sudo before 1
Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option.
VulnCheck
Sudo Inclusion of Functionality from Untrusted Control Sphere Vulnerability
vulncheck·2025·CVSS 9.3
CVE-2025-32463 [CRITICAL] CWE-829 Sudo Inclusion of Functionality from Untrusted Control Sphere Vulnerability
Sudo Inclusion of Functionality from Untrusted Control Sphere Vulnerability
Sudo contains an inclusion of functionality from untrusted control sphere vulnerability. This vulnerability could allow local attacker to leverage sudo’s -R (--chroot) option to run arbitrary commands as root, even if they are not listed in the sudoers file.
Affected: Sudo Sudo
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Exploitation References: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; https://www.rapid7.com/cdn/assets/bltbd2f1cd70f9e3e7f/691360b9c91291146f1a5308/threat-landscape-report-q3-2025.pdf; https://www.loginsoft.com/report
Elastic
Potential CVE-2025-32463 Nsswitch File Creation
elastic_rules·CVSS 7.8
CVE-2025-32463 [HIGH] Potential CVE-2025-32463 Nsswitch File Creation
Potential CVE-2025-32463 Nsswitch File Creation
Detects suspicious creation of the nsswitch.conf file, outside of the regular /etc/nsswitch.conf path,
consistent with attempts to exploit CVE-2025-32463 (the "sudo chroot" privilege escalation), where an
attacker tricks sudo into using attacker-controlled NSS files or libraries to gain root.
Query:
file where host.os.type == "linux" and event.type == "creation" and file.path like "/*/etc/nsswitch.conf" and
process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and
not file.path like (
"/var/tmp/mkinitramfs_*", "/tmp/tmp.*/mkinitramfs_*", "/var/tmp/dracut.*", "/tmp/user/0/mkinitramfs_*",
"/var/lib/aws-replication-agent/.tmp/mkinitramfs_*"
)
Sigma
Linux Sudo Chroot Execution
sigma·CVSS 7.8
CVE-2025-32463 [HIGH] Linux Sudo Chroot Execution
Linux Sudo Chroot Execution
Detects the execution of 'sudo' command with '--chroot' option, which is used to change the root directory for command execution.
Attackers may use this technique to evade detection and execute commands in a modified environment.
This can be part of a privilege escalation strategy, as it allows the execution of commands with elevated privileges in a controlled environment as seen in CVE-2025-32463.
While investigating, look out for unusual or unexpected use of 'sudo --chroot' in conjunction with other commands or scripts such as execution from temporary directories or unusual user accounts.
Detection:
condition: selection
selection:
CommandLine|contains:
- ' --chroot '
- 'sudo -R '
Image|endswith: /sudo
Log Source: category: process_creation
product: linux
Elastic
Potential CVE-2025-32463 Sudo Chroot Execution Attempt
elastic_rules·CVSS 7.8
CVE-2025-32463 [HIGH] Potential CVE-2025-32463 Sudo Chroot Execution Attempt
Potential CVE-2025-32463 Sudo Chroot Execution Attempt
Detects suspicious use of sudo's --chroot / -R option consistent with attempts to exploit CVE-2025-32463
(the "sudo chroot" privilege escalation), where an attacker tricks sudo into using attacker-controlled
NSS files or libraries to gain root.
Query:
process where host.os.type == "linux" and event.type == "start" and
event.action in ("exec", "exec_event", "start", "executed", "process_started", "ProcessRollup2") and
process.name == "sudo" and process.args like ("-R", "--chroot*") and
// To enforce the -R and --chroot arguments to be for sudo specifically, while wildcarding potential full sudo paths
process.command_line like ("*sudo -R*", "*sudo --chroot*")
Exploit-DB
Sudo chroot 1.9.17 - Local Privilege Escalation
exploitdb·2025-07-08·CVSS 9.3
CVE-2025-32463 [CRITICAL] Sudo chroot 1.9.17 - Local Privilege Escalation
Sudo chroot 1.9.17 - Local Privilege Escalation
---
Exploit Title: Sudo chroot 1.9.17 - Local Privilege Escalation
Google Dork: not aplicable
Date: Mon, 30 Jun 2025
Exploit Author: Stratascale
Vendor Homepage:https://salsa.debian.org/sudo-team/sudo
Software Link:
Version: Sudo versions 1.9.14 to 1.9.17 inclusive
Tested on: Kali Rolling 2025-7-3
CVE : CVE-2025-32463
*Version running today in Kali:*
https://pkg.kali.org/news/640802/sudo-1916p2-2-imported-into-kali-rolling/
*Background*
An attacker can leverage sudo's -R (--chroot) option to run
arbitrary commands as root, even if they are not listed in the
sudoers file.
Sudo versions affected:
Sudo versions 1.9.14 to 1.9.17 inclusive are affected.
CVE ID:
This vulnerability has been assigned CVE-2025-32463 in the
Common Vulnerabilit
Nuclei
Sudo - Local Privilege Escalation via chroot
nuclei·CVSS 7.8
CVE-2025-32463 [HIGH] Sudo - Local Privilege Escalation via chroot
Sudo - Local Privilege Escalation via chroot
Sudo before 1.9.17p1 allows local users to obtain root access by using /etc/nsswitch.conf from a user-controlled directory with the --chroot (-R) option.
Template:
id: CVE-2025-32463
info:
name: Sudo - Local Privilege Escalation via chroot
author: SeungAh-Hong
severity: critical
description: |
Sudo before 1.9.17p1 allows local users to obtain root access by using /etc/nsswitch.conf from a user-controlled directory with the --chroot (-R) option.
impact: |
A local attacker can escalate privileges to root by placing a crafted nsswitch.conf file and a malicious NSS library in a writable chroot directory, enabling arbitrary code execution with root privileges.
remediation: |
Upgrade sudo to version 1.9.17p1 or later.
reference:
- https://nvd.nist
Metasploit
Sudo Chroot 1.9.17 Privilege Escalation
metasploit
Sudo Chroot 1.9.17 Privilege Escalation
Sudo Chroot 1.9.17 Privilege Escalation
Sudo before version 1.19.17p1 allows user to use `chroot` option, when executing command. The option is intended to run a command with user-selected root directory (if sudoers file allow it). Change in version 1.9.14 allows resolving paths via `chroot` using user-specified root directory when sudoers is still evaluating. This allows the attacker to trick Sudo into loading arbitrary shared object, thus resulting in a privilege escalation.
Securelist
What’s in the container? Analyzing vulnerabilities, risks and protection with Kaspersky Container Security and the KIRA AI assistant
blogs_securelist·2026-05-29
CVE-2025-55182 What’s in the container? Analyzing vulnerabilities, risks and protection with Kaspersky Container Security and the KIRA AI assistant
Yaroslav Shmelev
Anton Kivva
Denis Parinov
Vladimir Kuskov
Yanina Balandyuk-Opalinskaya
Table of Contents
Introduction
Software vulnerabilities and compromise of update sources
Configuration vulnerabilities
Insecure handling of credentials
Use of default passwords
Passing passwords via command arguments
Privilege escalation in the container
Attacks on sudo
Insecure file permissions
Lack of integrity checks
Conclusion
Authors
Yaroslav Shmelev
Anton Kivva
Denis Parinov
Vladimir Kuskov
Yanina Balandyuk-Opalinskaya
## Introduction
Containerization using Docker has become firmly established in modern development standards, significantly increasing the speed and convenience of deploying various services. Developers often use ready-made Docker images, making only minimal c
Checkpoint
6th October – Threat Intelligence Report
blogs_checkpoint·2025-10-06
CVE-2025-41244 6th October – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 6th October – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 6th October, please download our Threat Intelligence Bulletin .
TOP ATTACKS AND BREACHES
Red Hat has confirmed a cyber attack that resulted in unauthorized access to one of its GitLab instances. The attackers, Crimson Collective, claim to have stolen approximately 570GB of compressed data. The data includes 28,000 internal repositories, including around 800 Customer Engagement Reports containing sensitive infra
Bleepingcomputer
CISA warns of critical Linux Sudo flaw exploited in attacks
blogs_bleepingcomputer·2025-09-30·CVSS 9.3
CVE-2025-32463 [CRITICAL] CISA warns of critical Linux Sudo flaw exploited in attacks
## CISA warns of critical Linux Sudo flaw exploited in attacks
## Ionut Ilascu
Hackers are actively exploiting a critical vulnerability (CVE-2025-32463) in the sudo package that enables the execution of commands with root-level privileges on Linux operating systems.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, describing it as “an inclusion of functionality from untrusted control sphere.”
CISA has given federal agencies until October 20 to apply the official mitigations or discontinue the use of sudo .
A local attacker can exploit this flaw to escalate privileges by using the -R (--chroot) option, even if they are not included in the sudoers list, a configuration file that specifies
Wiz
Crying Out Cloud Newsletter - August 2025 | Wiz
blogs_wiz·2025-08-10·CVSS 9.0
[CRITICAL] Crying Out Cloud Newsletter - August 2025 | Wiz
Welcome back! This month we’ve seen a lot of action, with both vulnerabilities and security incidents that have left users affected. We bring you the latest cloud security highlights, to help you stay informed and stay secure. Let's dive in.
## 🔍 Highlights
## Soco404 Cryptomining Campaign Exploits PostgreSQL and Cloud Misconfigurations
Wiz Research has uncovered the Soco404 campaign. A sophisticated, multi-platform cryptomining operation targeting cloud environments through exposed PostgreSQL instances, vulnerable Apache Tomcat servers, and other misconfigurations. The campaign delivers Linux and Windows payloads via fake 404 error pages embedded with base64 malware hosted on compromised or deceptive websites, including Google Sites and fraudulent crypto platforms. The attackers use a
Recorded Future
September 2025 CVE Landscape
blogs_recorded_future·CVSS 7.2
[HIGH] September 2025 CVE Landscape
# September 2025 CVE Landscape
In September 2025, Recorded Future’s Insikt Group® identified sixteen high-impact vulnerabilities that should be prioritized for remediation. This represents a decrease from the eighteen identified in August, with the number of Very Critical vulnerabilities also decreasing (11) month over month.
These vulnerabilities have affected the following vendors: Sudo, Libraesva, Fortra, Cisco, Adminer, Google, Dassault Systèmes, Linux, Android, Sitecore, TP-Link, and Meta Platforms.
September was dominated by flaws in Cisco and TP-Link, which together represented six of the sixteen vulnerabilities. Cisco’s IOS, IOS XE, and Secure Firewall products were affected by flaws, including stack-based and classic buffer overflows (CWE-121, CWE-120) and missing authorization
Bugzilla
CVE-2025-32463 sudo: LPE via chroot option
bugzilla·2025-06-24·CVSS 8.8
CVE-2025-32463 [HIGH] CVE-2025-32463 sudo: LPE via chroot option
CVE-2025-32463 sudo: LPE via chroot option
An attacker can leverage sudo's `-R` (`--chroot`) option to run arbitrary commands as root, even if they are not listed in the sudoers file. Sudo versions 1.9.14 to 1.9.17 inclusive are affected.
Discussion:
The sudo versions in Fedora 41, 42, and Rawhide are all 1.9.15, which is an affected version. Since this security issue has high severity, could the latest sudo version be packed as soon as possible?
---
The sudo's chroot feature should be removed asap
---
There is public PoC for this vulnerability.
https://github.com/pr0v3rbs/CVE-2025-32463_chwoot
https://www.stratascale.com/vulnerability-alert-CVE-2025-32463-sudo-chroot
Works like charm on Fedora 41
---
(In reply to Michal Ambroz from comment #4)
> There is public PoC for this vul
https://access.redhat.com/security/cve/cve-2025-32463https://bugs.gentoo.org/show_bug.cgi?id=CVE-2025-32463https://explore.alas.aws.amazon.com/CVE-2025-32463.htmlhttps://security-tracker.debian.org/tracker/CVE-2025-32463https://ubuntu.com/security/notices/USN-7604-1https://www.openwall.com/lists/oss-security/2025/06/30/3https://www.secpod.com/blog/sudo-lpe-vulnerabilities-resolved-what-you-need-to-know-about-cve-2025-32462-and-cve-2025-32463/https://www.stratascale.com/vulnerability-alert-CVE-2025-32463-sudo-chroothttps://www.sudo.ws/releases/changelog/https://www.sudo.ws/security/advisories/https://www.sudo.ws/security/advisories/chroot_bug/https://www.suse.com/security/cve/CVE-2025-32463.htmlhttps://www.suse.com/support/update/announcement/2025/suse-su-202502177-1/https://www.vicarius.io/vsociety/posts/cve-2025-32463-detect-sudo-vulnerabilityhttps://www.vicarius.io/vsociety/posts/cve-2025-32463-mitigate-sudo-vulnerabilityhttps://iototsecnews.jp/2025/07/01/linux-sudo-chroot-vulnerability-enables-hackers-to-elevate-privileges-to-root/https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-32463
2025-06-30
Published
2025-09-29
Added to CISA KEV
Exploited in the wild