Executive brief
Sudo, a widely used utility for managing administrative permissions on Linux and Unix systems, contains a vulnerability that allows standard users to gain full root access. By exploiting the tool's chroot feature, an attacker can bypass security restrictions and execute unauthorized commands with the highest level of system privileges. This could lead to a complete system takeover, data theft, or permanent disruption of services.
Technical details
A vulnerability exists in Sudo versions 1.9.14 through 1.9.17p1 due to the improper handling of the --chroot (-R) option. When this option is used, Sudo may process the /etc/nsswitch.conf file from within the user-specified (and potentially untrusted) chroot directory before it has fully dropped privileges or validated the environment. A local attacker can create a malicious nsswitch.conf and associated shared libraries within a directory they control, then execute sudo with the --chroot flag to trigger the loading of these libraries. This results in arbitrary code execution as the root user, bypassing sudoers policy restrictions. The issue is addressed in Sudo version 1.9.17p1.
Affected products
- Sudo Project Sudo 1.9.14 to 1.9.17p1
Timeline
- 2025-06-30: disclosed: Public disclosure via Openwall oss-security list
- 2025-09-29: kev added: Added to CISA Known Exploited Vulnerabilities catalog
- 2025-09-29: advisory: NVD publication date