CVE-2025-32463

Published Jun 30, 2025

Last updated a year ago

Exploit known CVSS critical 9.3

sudo

chwoot

Ubuntu

Server

Port (22)

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-32463 is a vulnerability that affects Sudo versions 1.9.14 to 1.9.17 inclusive. It allows a local user to gain root access. This is possible because the `/etc/nsswitch.conf` file from a user-controlled directory is used with the `--chroot` option. An attacker can exploit this vulnerability by using Sudo's `-R` or `--chroot` option to execute arbitrary commands as root, even if they are not listed in the `sudoers` file. The vulnerability was fixed in Sudo version 1.9.17p1.

Description: Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option.
Source: cve@mitre.org
NVD status: Analyzed
Products: sudo, ubuntu_linux, debian_linux, leap, enterprise_linux, linux_enterprise_desktop, linux_enterprise_real_time, linux_enterprise_server_for_sap

Insights

Analysis from the Intruder Security Team

Published Jul 2, 2025 Updated Jul 2, 2025

This is a serious local privilege escalation vulnerability in the sudo tool, which is present on most Unix systems. You should update this as soon as possible if your version is less than 1.9.14.

Exploiting this vulnerability requires an attacker to have access to the machine already - so it's most serious in environments where lower-privileged users routinely have access to systems. However, all vulnerable systems should be patched.

Risk scores

CVSS 3.1

Type: Primary
Base score: 7.8
Impact score: 5.9
Exploitability score: 1.8
Vector string: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Known exploits

Data from CISA

Vulnerability name: Sudo Inclusion of Functionality from Untrusted Control Sphere Vulnerability
Exploit added on: Sep 29, 2025
Exploit action due: Oct 20, 2025
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weaknesses

cve@mitre.org: CWE-829

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:sudo_project:sudo:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "91CD68ED-9A18-47B6-91E5-C20D2F69AB65",
            "versionEndExcluding": "1.9.17",
            "versionStartIncluding": "1.9.14",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:sudo_project:sudo:1.9.17:-:*:*:*:*:*:*",
            "matchCriteriaId": "B563C690-EE9A-437C-9410-54209F82F827",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  },
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:canonical:ubuntu_linux:22.04:*:*:*:lts:*:*:*",
            "matchCriteriaId": "359012F1-2C63-415A-88B8-6726A87830DE",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:canonical:ubuntu_linux:24.04:*:*:*:lts:*:*:*",
            "matchCriteriaId": "BF90B5A4-6E55-4369-B9D4-E7A061E797D2",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:canonical:ubuntu_linux:24.10:*:*:*:-:*:*:*",
            "matchCriteriaId": "418A8B25-A287-4218-A10E-F9345A8E2EB7",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:canonical:ubuntu_linux:25.04:*:*:*:-:*:*:*",
            "matchCriteriaId": "6B40C5AB-76D5-44E1-A571-B9A44522C6BE",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
            "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*",
            "matchCriteriaId": "46D69DCC-AE4D-4EA5-861C-D60951444C6C",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:debian:debian_linux:13.0:*:*:*:*:*:*:*",
            "matchCriteriaId": "204FC6CC-9DAC-45FB-8A9F-C9C8EDD29D54",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:opensuse:leap:15.6:*:*:*:*:*:*:*",
            "matchCriteriaId": "78B4F1C7-A301-4C94-A41C-A51182B83677",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*",
            "matchCriteriaId": "D65C2163-CFC2-4ABB-8F4E-CB09CEBD006C",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:suse:linux_enterprise_desktop:15:sp6:*:*:*:*:*:*",
            "matchCriteriaId": "B83183BD-A440-4697-8DD8-8A478C428984",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:suse:linux_enterprise_desktop:15:sp7:*:*:*:*:*:*",
            "matchCriteriaId": "B4388826-A383-4FBA-819A-363EAF6183DE",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:suse:linux_enterprise_real_time:15.0:sp2:*:*:*:*:*:*",
            "matchCriteriaId": "4B0AC584-5E26-4ACE-BC19-9E69A302F238",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:suse:linux_enterprise_real_time:15.0:sp6:*:*:*:*:*:*",
            "matchCriteriaId": "E8772290-7B8F-4FF3-8114-0535E84E10F5",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:suse:linux_enterprise_real_time:15.0:sp7:*:*:*:*:*:*",
            "matchCriteriaId": "BF782A24-9E6B-4897-9402-37DBCA7A7332",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:suse:linux_enterprise_server_for_sap:12:sp6:*:*:*:*:*:*",
            "matchCriteriaId": "44807632-7775-4496-9217-5F5816943D29",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:suse:linux_enterprise_server_for_sap:12:sp7:*:*:*:*:*:*",
            "matchCriteriaId": "2F46E618-B5F5-4CA1-8023-8E9C3E1772A2",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.