CISA Warns of Linux Sudo Vulnerability Actively Exploited in Attacks

CISA has issued an advisory concerning a critical vulnerability in the Linux and Unix sudo utility, identified as CVE-2025-32463 . This vulnerability is currently being actively exploited.

The flaw enables local attackers to bypass access controls and execute arbitrary commands with root privileges, even if they lack explicit sudoers permissions.

The vulnerability, categorized as “Inclusion of Functionality from Untrusted Control Sphere,” arises from insufficient validation in the handling of the -R (–chroot) option.

When running the command sudo -R /path/to/chroot , the utility fails to ensure the security of the target directory. Attackers can create a malicious chroot environment to deceive sudo into executing code with elevated privileges.

This attack vector is associated with CWE-829 (Inclusion of Functionality from Untrusted Control Sphere).

Potential exploit scenarios include local users creating directories with manipulated symbolic links and configuration files.

Running sudo -R attacker_dir /bin/sh can spawn a root shell irrespective of sudoers restrictions, potentially integrating into post-exploitation toolkits, facilitating full system takeover.

Although there are no confirmed reports of this vulnerability being used in known ransomware campaigns to date, unprivileged local users gaining root access poses significant risks.

CISA has set a remediation deadline of 2025-10-20. Systems that remain unpatched are at risk of a complete compromise of confidentiality, integrity, and availability.

Risk Factors Details

Affected Products Sudo versions prior to 1.9.14p2 on Linux/Unix

Impact Local privilege escalation—attacker gains root shell

Exploit Prerequisites Ability to create a malicious chroot directory

CVSS 3.1 Score 9.3 (Critical)

Organizations using any version of sudo released prior to the patched versions should take immediate action:

Update to the latest sudo release as specified in the Sudo project advisory. If unable to apply patches, disable the -R option by adding Defaults !use_chroot in /etc/sudoers . For cloud and managed services, adhere to binding operational directives to maintain secure configuration baselines. Scan systems for unusual chroot usage patterns and review logs for sudo invocations referencing untrusted directories.

CISA’s alert stresses the importance of vigilant patch management and continuous monitoring. Administrators should ensure compliance with vendor instructions or discontinue vulnerable implementations if mitigations are not feasible.

Failure to address this vulnerability by the 2025-10-20 deadline may result in unauthorized root access, data breaches, or system-wide compromise.

Based on reporting by Cyber Security News.