{"id":"CVE-2025-32463","kind":"vulnerability","aliases":["CVE-2025-32463"],"related":[],"title":"Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled…","description":"Sudo contains an inclusion of functionality from untrusted control sphere vulnerability. This vulnerability could allow local attacker to leverage sudo’s -R (--chroot) option to run arbitrary commands as root, even if they are not listed in the sudoers file.\n\nCISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","summary":"Sudo's -R (--chroot) option can be abused by a local user to run arbitrary commands as root, even without a sudoers entry. The attacker gets full root on the machine.","severity":"critical","cvss":9.3,"epss":null,"exploited":true,"exploited_at":"2025-09-29T00:00:00+00:00","products":[{"name":"Sudo Sudo","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"sudo project sudo","fixed":["1.9.17"],"affected":">= 1.9.14, < 1.9.17","ecosystem":"vendor"},{"name":"sudo project sudo","fixed":[],"affected":"= 1.9.17","ecosystem":"vendor"},{"name":"canonical ubuntu linux","fixed":[],"affected":"= 22.04","ecosystem":"vendor"},{"name":"canonical ubuntu linux","fixed":[],"affected":"= 24.04","ecosystem":"vendor"},{"name":"canonical ubuntu linux","fixed":[],"affected":"= 24.10","ecosystem":"vendor"},{"name":"canonical ubuntu linux","fixed":[],"affected":"= 25.04","ecosystem":"vendor"},{"name":"debian linux","fixed":[],"affected":"= 11.0","ecosystem":"vendor"},{"name":"debian linux","fixed":[],"affected":"= 12.0","ecosystem":"vendor"},{"name":"debian linux","fixed":[],"affected":"= 13.0","ecosystem":"vendor"},{"name":"opensuse leap","fixed":[],"affected":"= 15.6","ecosystem":"vendor"},{"name":"redhat enterprise linux","fixed":[],"affected":"= 10.0","ecosystem":"vendor"},{"name":"suse linux enterprise desktop","fixed":[],"affected":"= 15","ecosystem":"vendor"},{"name":"suse linux enterprise real time","fixed":[],"affected":"= 15.0","ecosystem":"vendor"},{"name":"suse linux enterprise server for sap","fixed":[],"affected":"= 12","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","linux","package","self-hosted","sudo"],"not_affected_if":["no-local-users","sudo-not-installed"],"how_to_check":"Run sudo -V and compare the version to the fixed release in the vendor advisory. Confirm the sudo binary is the one distributed by the OS package manager.","fix":"Upgrade sudo to a patched version from the vendor or your OS distribution. If no patch is available, follow CISA mitigation guidance or stop using sudo's -R option.","status":"open","published_at":"2025-06-30T21:15:30+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:44:47+00:00","updated_at":"2026-10-23T23:44:51+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T20:44:47Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade sudo to a patched version from the vendor or your OS distribution. If no patch is available, follow CISA mitigation guidance or stop using sudo's -R option.","reach":"local","summary":"Sudo's -R (--chroot) option can be abused by a local user to run arbitrary commands as root, even without a sudoers entry. The attacker gets full root on the machine.","category":"package","who_cares":["linux","self-hosted","sudo"],"confidence":0.8,"needs_auth":"yes","worst_case":"Local user runs arbitrary commands as root, bypassing sudoers restrictions entirely.","analyst_note":"Affected and fixed version ranges are unknown in the source; check the Sudo advisory and the vendor's patched release list.","how_to_check":"Run sudo -V and compare the version to the fixed release in the vendor advisory. Confirm the sudo binary is the one distributed by the OS package manager.","needs_analyst":true,"not_affected_if":["no-local-users","sudo-not-installed"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000452,"input_tokens":2575,"output_tokens":390,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-01':161C '-2025':20A,23A '-32463':21A,24A '/etc/nsswitch.conf':13A '1.9.17':3A '22':160C 'abus':85B 'access':11A 'action':151C 'allow':5A,123C 'appli':152C 'applic':158C 'arbitrari':92B,135C 'attack':102B,125C 'bod':159C 'canonical':33A,36A,39A,42A 'chroot':81B,131C 'cisa':149C 'cloud':164C 'command':93B,136C 'contain':110C 'control':18A,117C 'could':122C 'cve':19A,22A 'debian':45A,47A,49A 'desktop':59A 'discontinu':167C 'enterprise':54A,58A,62A,67A 'entri':100B 'even':96B,139C 'exploit':71B 'file':148C 'follow':157C 'for':69A 'full':104B 'function':114C 'get':103B 'guidanc':162C 'host':76B 'inclus':112C 'instruct':156C 'leap':52A 'leverag':127C 'linux':35A,38A,41A,44A,46A,48A,50A,55A,57A,61A,66A,72B 'list':144C 'local':6A,88B,124C 'machin':108B 'mitig':153C,173C 'obtain':9A 'opensuse':51A 'option':82B,132C 'p1':4A 'packag':73B 'per':154C 'product':171C 'project':28A,31A 'r':80B,130C 'real':63A 'redhat':53A 'requir':150C 'root':10A,95B,105B,138C 'run':91B,134C 'sap':70A 'self':75B 'self-host':74B 'server':68A 'servic':165C 'sphere':118C 'sudo':1A,25A,26A,27A,29A,30A,32A,77B,78B,109C,128C 'sudoer':99B,147C 'suse':56A,60A,65A 'time':64A 'ubuntu':34A,37A,40A,43A 'unavail':175C 'untrust':116C 'use':168C 'user':7A,17A,89B 'user-control':16A 'vendor':155C 'vulner':119C,121C 'without':97B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2025-06-30T21:15:30+00:00","kev":{"dateAdded":"2025-09-29","dueDate":"2025-10-20","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_by":"cve@mitre.org","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2025-32463","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-32463","severity":null,"published_at":"2025-09-29T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T12:39:22+00:00","note":null},{"source":"nvd","external_id":"CVE-2025-32463","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-32463","severity":null,"published_at":"2025-06-30T21:15:30+00:00","modified_at":"2026-06-17T09:12:02+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}