New PoC Exploit Released for Sudo Chroot Privilege Escalation Vulnerability

A recent vulnerability identified in the Sudo utility has resulted in the release of a proof-of-concept exploit, which is raising concerns among Linux system administrators globally.

The vulnerability, identified as CVE-2025-32463 , affects the chroot feature in Sudo versions 1.9.14 through 1.9.17. It allows local attackers to escalate privileges to root level.

Security researcher Rich Mirch discovered this flaw, which involves improper handling of user-specified root directories by Sudo, potentially enabling unauthorized command execution as the superuser.

This issue is rated critical with a CVSS score of 9.3 and highlights ongoing risks associated with privilege management tools in Unix-like operating systems.

Reports have confirmed active exploitation, prompting urgent patching recommendations from organizations such as CISA .

The vulnerability arises when Sudo improperly resolves paths under the --chroot option. An attacker can craft a malicious /etc/nsswitch.conf file within a controlled directory, leading Sudo to load an arbitrary shared library during command evaluation.

This exploit bypasses sudoers file restrictions, granting root privileges even to users not authorized for escalation. The flaw is particularly dangerous in environments such as servers and development machines where multiple users may be present.

Ubuntu and Red Hat have acknowledged that this vulnerability affects their distributions, and patches have been released in recent updates. Vulnerable systems include major Linux distributions such as Ubuntu 24.04 LTS, 24.10, and 25.04, as well as Red Hat Enterprise Linux variants and Debian-based setups with Sudo 1.9.14-1.9.17.

Legacy versions prior to 1.9.14 are not affected. Immediate mitigation involves updating to Sudo 1.9.17p1 or later, where the chroot feature is deprecated, and the path resolution flaw is corrected.

Administrators are advised to enable AppArmor or SELinux profiles to restrict Sudo operations and monitor logs for suspicious chroot invocations.

A GitHub repository by researcher kh4sh3i provides a PoC exploit. Users can clone the repository , execute a script, and observe the privilege escalation. Terminal screenshots demonstrate the process, showcasing the transition from a low-privilege user to root access.

This PoC underscores the vulnerability's reliability on unpatched systems and emphasizes the need for caution, as unauthorized deployment is illegal.

Systems running the affected Sudo versions are at risk of complete takeover by local threat actors, which could enable lateral movement within networks. Organizations delaying updates face increased exposure, especially in cloud and containerized environments reliant on Sudo for automation.

Aspect Details

CVE ID CVE-2025-32463

CVSS v3.1 Score 9.3 (Critical)

Attack Vector Local

Impact High Confidentiality, Integrity, Availability

Affected Versions Sudo 1.9.14 – 1.9.17

Patched Versions 1.9.17p1+

CISA has added this CVE to its Known Exploited Vulnerabilities catalog, and federal agencies are required to apply patches by October 2025.

Based on reporting by Cyber Security News.