Researchers Publish Technical Analysis of Linux Sudo Privilege Escalation

A critical local privilege escalation vulnerability, identified as CVE-2025-32463, has been discovered in the Linux sudo utility. This vulnerability affects sudo versions 1.9.14 through 1.9.17 and allows local attackers with standard sudo access to obtain full root privileges by exploiting the --chroot feature.

The vulnerability arises from a logic error in the --chroot (or -R ) option. Typically, chroot confines a process to a specified directory, but in this case, sudo applies the confinement before checking user permissions and before loading Name Service Switch (NSS) modules.

An attacker can place a malicious /etc/nsswitch.conf file inside a user-controlled chroot directory, forcing sudo to load a rogue shared library (.so) with root privileges via NSS’s dynamic module loading.

The issue stems from the sequence of operations in sudo’s source code. After invoking chroot() on the target directory, sudo continues to run as root. It then calls functions such as getpwuid() to verify user credentials. NSS reads the chrooted /etc/nsswitch.conf and loads libraries based on its contents, which can include malicious modules such as libnss_malicious.so.2 .

This vulnerability allows an attacker’s crafted library to execute arbitrary root-level code, requiring only local file write access and a writable directory like /tmp .

Environment Setup: Create a directory structure under /tmp/my_chroot with etc and lib/x86_64-linux-gnu subdirectories. NSS Configuration: Add a fake /tmp/my_chroot/etc/nsswitch.conf that loads a "malicious" module. Malicious Library: Compile a shared library with a constructor function that spawns a root shell. Triggering the Bug: Execute sudo -R /tmp/my_chroot /usr/bin/id to initiate chroot, NSS parsing, and library loading, resulting in a root shell.

The proof-of-concept code and detailed analysis are available on GitHub, illustrating each stage from system call tracing with strace to shell spawning.

Systems affected include Ubuntu 24.04+, Red Hat 8/9, SUSE, Amazon Linux, and macOS Ventura/Sonoma using vulnerable sudo releases. The flaw is particularly dangerous in containerized environments (Docker, Podman) where chroot escapes can compromise the host.

Patch Immediately: Upgrade to sudo 1.9.17p1 or later, which deprecates the chroot feature and performs permission checks before NSS loading. Disable chroot: Add Defaults !chroot in /etc/sudoers via visudo . Harden Temporary Directories: Mount /tmp with noexec,nosuid,nodev options. Enforce MAC Policies: Use SELinux or AppArmor to restrict NSS module loading. Audit chroot Calls: Utilize auditd to log chroot system calls for suspicious activity.

CVE-2025-32463 underscores the potential security risks of seemingly protective features. System administrators are urged to apply updates and mitigations promptly to prevent unauthorized root access. Continuous code reviews and responsible disclosure remain crucial for securing essential system utilities.

Based on reporting by GBHackers.