Executive brief
A vulnerability in the 'sd' command-line tool, a popular alternative to 'sed' for finding and replacing text, allows local users to gain unauthorized administrative (root) privileges. By using the tool to modify a file, an attacker can trick the system into changing file ownership while keeping dangerous 'setuid' permissions active. This could allow a low-privileged user to take full control of the affected system.
Technical details
A local privilege escalation vulnerability exists in chmln/sd through version 1.0.0 due to incorrect privilege assignment (CWE-266) during file modification. Unlike 'sed', which safely handles temporary files, 'sd' changes the group ownership of a target file to the user executing the command while preserving existing SUID/SGID bits. An attacker can exploit this by creating a SUID binary (like a copy of bash) and using 'sd' via a privileged execution wrapper (like sudo) to change the file's owner/group to a higher-privileged user. This allows the attacker to execute the binary with the elevated effective UID of the new owner. The issue is confirmed in bash environments.
Affected products
- chmln sd <= 1.0.0
Timeline
- 2025-12-10: disclosed: Initial disclosure and CVE assignment
- 2025-12-10: advisory: NVD publication and CISA-ADP enrichment