CVE-2025-32463
Sudo Inclusion of Functionality from Untrusted Control Sphere Vulnerability
Description
CVE-2025-32463 is a critical local privilege escalation vulnerability in Sudo before version 1.9.17p1, the ubiquitous privilege management tool on Unix-like systems. The vulnerability allows local users to obtain root access because the --chroot option causes Sudo to read /etc/nsswitch.conf from a user-controlled directory instead of the system directory. With a CVSS v3.1 base score of 9.3, this Sudo vulnerability affects versions 1.9.14 through 1.9.17 and impacts all major Linux distributions including Ubuntu, Debian, Red Hat Enterprise Linux, SUSE, and openSUSE. CISA has added CVE-2025-32463 to the Known Exploited Vulnerabilities catalog, and its EPSS score of 20.77% at the 95th percentile indicates a very high probability of active exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| sudo project | sudo | >= 1.9.14, < 1.9.17; 1.9.17 |
| canonical | ubuntu linux | 22.04; 24.04; 24.10; 25.04 |
| debian | debian linux | 11.0; 12.0; 13.0 |
| opensuse | leap | 15.6 |
| redhat | enterprise linux | 10.0 |
| suse | linux enterprise desktop | 15 |
| suse | linux enterprise real time | 15.0 |
| suse | linux enterprise server for sap | 12 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://access.redhat.com/security/cve/cve-2025-32463(Third Party Advisory)
- https://bugs.gentoo.org/show_bug.cgi?id=CVE-2025-32463(Issue Tracking, Third Party Advisory)
- https://explore.alas.aws.amazon.com/CVE-2025-32463.html(Third Party Advisory)
- https://security-tracker.debian.org/tracker/CVE-2025-32463(Third Party Advisory)
- https://ubuntu.com/security/notices/USN-7604-1(Third Party Advisory)
- https://www.openwall.com/lists/oss-security/2025/06/30/3(Third Party Advisory)
- https://www.secpod.com/blog/sudo-lpe-vulnerabilities-resolved-what-you-need-to-know-about-cve-2025-32462-and-cve-2025-32463/(Exploit, Third Party Advisory)
- https://www.stratascale.com/vulnerability-alert-CVE-2025-32463-sudo-chroot(Exploit, Third Party Advisory)
- https://www.sudo.ws/releases/changelog/(Release Notes)
- https://www.sudo.ws/security/advisories/(Vendor Advisory)
- https://www.sudo.ws/security/advisories/chroot_bug/(Vendor Advisory)
- https://www.suse.com/security/cve/CVE-2025-32463.html(Third Party Advisory)
- https://www.suse.com/support/update/announcement/2025/suse-su-202502177-1/(Third Party Advisory)
- https://www.vicarius.io/vsociety/posts/cve-2025-32463-detect-sudo-vulnerability(Third Party Advisory)
- https://www.vicarius.io/vsociety/posts/cve-2025-32463-mitigate-sudo-vulnerability(Mitigation, Third Party Advisory)
- https://iototsecnews.jp/2025/07/01/linux-sudo-chroot-vulnerability-enables-hackers-to-elevate-privileges-to-root/(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-32463(US Government Resource)
Weakness Type
CWE-829: Inclusion of Functionality from Untrusted Control Sphere
CVE-2025-32463 is classified under CWE-829 (Inclusion of Functionality from Untrusted Control Sphere), which occurs when a product includes executable functionality from a source outside of its intended control sphere. In this case, Sudo's --chroot option causes the program to read the /etc/nsswitch.conf configuration file from within the chroot directory, which can be controlled by the local user. By placing a crafted nsswitch.conf in the user-controlled directory, an attacker can redirect Sudo's name service lookups to a malicious shared library, achieving code execution with root privileges.
Learn more: CWE-829 — Inclusion of Functionality from Untrusted Control Sphere
Impact Analysis
CVE-2025-32463 is extremely severe due to the fundamental role of Sudo in Unix-like systems. The vulnerability is locally exploitable (AV:L) with low attack complexity (AC:L), requiring no prior privileges (PR:N) and no user interaction (UI:N), and critically the scope is changed (S:C), meaning the exploit can affect resources beyond the vulnerable component. Confidentiality (High): Gaining root access allows the attacker to read all files on the system, including shadow password files, private keys, database credentials, and encrypted storage keys. Integrity (High): Root access enables modification of any system file, installation of rootkits, modification of audit logs, and alteration of security configurations. Availability (High): A root-level attacker can shut down services, destroy data, and render the system inoperable. The CVSS score of 9.3 (Critical) with scope changed reflects that the impact extends beyond Sudo itself to the entire operating system. With an EPSS score of 20.77% at the 95th percentile and the massive install base of Sudo across Linux distributions, this vulnerability has a very broad exploitation surface.
Exploit Maturity
CVE-2025-32463 demonstrates high exploit maturity with multiple public exploit sources. Detailed exploit and analysis information is available from SecPod and StrataScale, both tagged as providing exploit details. CISA has confirmed active exploitation by adding this vulnerability to the Known Exploited Vulnerabilities catalog. The EPSS score of 20.77% at the 95th percentile indicates a very high exploitation probability. The Sudo project has published a dedicated security advisory for the chroot bug, confirming the vulnerability and providing technical details. Local privilege escalation vulnerabilities in Sudo are historically among the most quickly weaponized flaws, as they provide a reliable path from unprivileged access to full system compromise.
Remediation
-
Upgrade Sudo to version 1.9.17p1 or later immediately. The fix is available from the Sudo project release notes. The CISA required action states to apply mitigations per vendor instructions or discontinue use of the product.
-
Apply distribution-specific patches. Sudo versions 1.9.14 through 1.9.17 are affected. Major distributions have released patches: Ubuntu (USN-7604-1), Debian, Red Hat Enterprise Linux 10.0, SUSE Linux Enterprise Desktop/Server 15, openSUSE Leap 15.6. Apply the appropriate package update for your distribution.
-
Restrict use of the --chroot option as an interim mitigation if immediate patching is not possible. Review sudoers configuration files for any rules that permit or use the --chroot option and disable them until the patch is applied. The vulnerability specifically requires the --chroot functionality to be available.
-
Audit systems for signs of exploitation. Review authentication logs, sudo logs, and system logs for suspicious sudo invocations with --chroot. Check for unauthorized privilege escalation, new root-owned processes, and modifications to system files that indicate root compromise. Pay particular attention to systems where unprivileged users have shell access.
-
Implement defense in depth for privilege management. Enable comprehensive sudo logging and monitoring. Use SELinux or AppArmor to restrict the actions available even after privilege escalation. Maintain an inventory of all systems running Sudo and automate security update deployment to minimize the window of exposure for future vulnerabilities.
Technical Details
CVE-2025-32463 is a local privilege escalation vulnerability in Sudo versions 1.9.14 through 1.9.17. The CVSS v3.1 vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H indicates a locally exploitable vulnerability with no complexity, no authentication, no user interaction, and changed scope, with maximum CIA impact. The vulnerability is classified as CWE-829 (Inclusion of Functionality from Untrusted Control Sphere). When Sudo is invoked with the --chroot option, it changes the root directory before performing name service lookups for user and group resolution. The flaw is that Sudo reads /etc/nsswitch.conf relative to the chroot directory rather than the real system root. A local attacker can create a chroot directory structure containing a crafted nsswitch.conf that specifies a malicious name service module (shared library). When Sudo processes this nsswitch.conf, it loads and executes the attacker-controlled library with root privileges, as Sudo runs as setuid root. The changed scope (S:C) in the CVSS vector reflects that the initial vulnerability is in Sudo's chroot handling, but the resulting compromise extends to the entire operating system through root privilege acquisition.
Frequently Asked Questions
Is CVE-2025-32463 being actively exploited?
Yes. CISA has confirmed active exploitation by adding CVE-2025-32463 to the Known Exploited Vulnerabilities catalog with a remediation deadline of October 20, 2025. The EPSS score of 20.77% at the 95th percentile indicates very high exploitation activity. Multiple public exploit analyses are available.
What products are affected by CVE-2025-32463?
Sudo versions 1.9.14 through 1.9.17 (before 1.9.17p1) are affected. This impacts all major Linux distributions including Ubuntu 22.04, 24.04, 24.10, and 25.04; Debian 11, 12, and 13; Red Hat Enterprise Linux 10; SUSE Linux Enterprise Desktop and Server 15; and openSUSE Leap 15.6.
How do I fix CVE-2025-32463?
Upgrade Sudo to version 1.9.17p1 or later. Apply the patch from your Linux distribution's package repository. As an interim mitigation, disable or restrict the use of Sudo's --chroot option in your sudoers configuration.
How severe is CVE-2025-32463?
CVE-2025-32463 is rated Critical with a CVSS v3.1 base score of 9.3. It allows local users to escalate privileges to root through Sudo's --chroot option. The "scope changed" designation indicates the impact extends beyond Sudo to the entire operating system. Its EPSS score of 20.77% at the 95th percentile confirms active exploitation in the wild.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.