PoC Exploit Released for Sudo Vulnerability that Enables Attackers to Gain Root Access
A proof-of-concept (PoC) exploit has been released for CVE-2025-32463 , a local privilege escalation flaw in the Sudo utility that can grant root access under specific configurations.
A proof-of-concept (PoC) exploit has been released for CVE-2025-32463 , a local privilege escalation flaw in the Sudo utility that can grant root access under specific configurations.
Security researcher Rich Mirch is credited with identifying this vulnerability. A PoC and usage guide are available in an open GitHub repository, highlighting the need for patching across Linux systems that utilize Sudo's chroot functionality.
Versions 1.9.14 through 1.9.17 of Sudo are affected, with fixes available in version 1.9.17p1 and later. Systems using builds prior to 1.9.14 are not impacted as the chroot feature was not present in those versions.
Local Privilege Escalation Flaw (CVE-2025-32463)
The vulnerability is related to how Sudo handles chroot-related invocation paths and environments when executing commands with elevated privileges.
A low-privileged user may exploit the chroot feature to break out of the constrained environment and execute commands as root.
This vulnerability allows for potential full system compromise when Sudo policies permit chroot usage.
The PoC demonstrates the exploitation process: verify the target Sudo version, execute the exploit script, and observe the effective UID/GID change to root.
Security researcher Rich Mirch is credited with identifying this vulnerability.
Testing shows that users transition from uid=1001 to uid=0 after executing the script, confirming successful privilege escalation.
The issue is categorized as "Local Privilege Escalation to Root via Sudo chroot in Linux," dependent on local account access and specific Sudo configurations that allow chroot execution.
Risk Factors Details
Affected Products Sudo versions 1.9.14 through 1.9.17
Impact Local privilege escalation
Exploit Prerequisites Local user access with ability to invoke sudo under misconfigured chroot settings
CVSS 3.1 Score Not yet assigned
Immediate remediation involves upgrading Sudo to version 1.9.17p1 or newer on affected systems. Administrators should harden Sudoers policies to deny or restrict chroot usage and enforce least privilege where upgrades are pending.
Access control frameworks like AppArmor or SELinux can further constrain Sudo behavior and contain potential abuse during change windows.
From a detection standpoint, it is advisable to monitor for unusual Sudo invocations referencing chroot or unexpected working directories, correlate privilege transitions (uid changes to 0) from non-standard shells or paths, and alert on rapid "id → exploit → id" sequences typical in exploitation tests.
Based on reporting by Cyber Security News.