CVE-2025-32463: Sudo Inclusion of Functionality from Untrusted Control Sphere Vulnerability
An attacker can leverage sudo's -R (--chroot) option to run arbitrary commands as root, even if they are not listed in the sudoers file. Sudo versions 1.9.14 to 1.9.17 inclusive are affected.
Other sources
Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option.
— NVD
Sudo contains an inclusion of functionality from untrusted control sphere vulnerability. This vulnerability could allow local attacker to leverage sudo’s -R (--chroot) option to run arbitrary commands as root, even if they are not listed in the sudoers file.
— CISA
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/sudoto a version that resolves this vulnerability.Fixed in 1.9.13p3-1+deb12u4Fixed in 1.9.13p3-1+deb12u2Fixed in 1.9.16p2-3+deb13u2Fixed in 1.9.17p2-7 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.9.17p1 - Compensating control
Do not use sudo’s -R (--chroot) option in environments where mitigation is not available; local attackers could leverage this option to run arbitrary commands as root even if not listed in sudoers.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-32463?
CVE-2025-32463 is considered a critical vulnerability due to its potential to allow local users to gain root access.
How do I fix CVE-2025-32463?
To mitigate CVE-2025-32463, update Sudo to version 1.9.17p1 or later.
Which versions of Sudo are affected by CVE-2025-32463?
Sudo versions prior to 1.9.17p1 are affected by CVE-2025-32463.
Can CVE-2025-32463 be exploited remotely?
No, CVE-2025-32463 is a local privilege escalation vulnerability requiring local access to exploit.
What systems are impacted by CVE-2025-32463?
CVE-2025-32463 impacts systems using vulnerable versions of Sudo, particularly those utilizing the --chroot option.