Staying informed about security vulnerabilities is crucial, especially those that can significantly impact systems. Recently, two significant vulnerabilities related to the sudo software have been disclosed under the identifiers CVE-2025-32462 and CVE-2025-32463. Sudo is a Unix/Linux program that allows a system administrator to delegate certain privileges to specific users, enabling them to execute commands as another user (often the root user).
The CVE-2025-32462 vulnerability is a local privilege escalation (LPE) flaw affecting sudo prior to version 1.9.17p1. It occurs when the sudoers file (sudo's configuration file) specifies a host that is neither the current host nor ALL. In such specific and non-default configurations, listed users can execute commands on unintended machines. This flaw poses a risk to system security.
This sudo vulnerability is particularly concerning for environments that share a single sudoers configuration file across multiple machines or that use network-based user directories (like LDAP) to provide sudoers rules to a system. It can lead to a bypass of existing security measures.
Although this is a local privilege escalation (requiring an authenticated account to exploit), the impact is considered Important because it allows an unprivileged attacker to execute arbitrary commands with elevated privileges in specific configurations. The associated CVSS v3.1 score is 2.8 (Low) according to Ubuntu, though Red Hat has a score of 7.8. The difference is due to vendor-specific factors, such as versions or build chain. Understanding these scores is essential for vulnerability analysis.
At Saturne, we rigorously select qualified developers , capable of meeting the technical and strategic requirements of the most ambitious companies. Here is an overview of some representative profiles from our international network: expertise, reliability and commitment at the service of your projects
This software vulnerability affects sudo versions prior to 1.9.17p1 and has been patched in that version. Many Linux distributions and Unix-based operating systems are impacted, including but not limited to:
sudo)The primary mitigation measure is to update sudo to version 1.9.17p1 or later. This is the most effective way to patch the vulnerability.
For specific environments:
sudoers files: Remove rules defined in sudoers files that pertain to systems other than the local system.CVE-2025-32463 is a critical local privilege escalation vulnerability affecting sudo versions from 1.9.14 to 1.9.17. This flaw allows local users to gain root access even if they are not listed in the sudoers file. The vulnerability is due to a change introduced in sudo 1.9.14, where paths are resolved within the chrooted environment *before* the sudoers file is evaluated. This is a major security flaw.
An attacker can exploit this by creating a malicious /etc/nsswitch.conf file in a user-specified root directory. This malicious file can then force sudo to load arbitrary shared libraries (like libnss_/woot1337.so.2), allowing arbitrary code execution with root privileges. Such an RCE vulnerability (remote code execution, although local here) is extremely dangerous.
sudoers file.This critical vulnerability has a CVSS v3.1 score of 9.3 (Critical), indicating a very high risk to cybersecurity.
This vulnerability affects sudo versions from 1.9.14 to 1.9.17. It has been patched in version 1.9.17p1. Affected systems include, but are not limited to:
sudo)The most important solution is to update sudo to version 1.9.17p1 or later. This is the essential security patch to apply.
The fix for this vulnerability reverts changes made in version 1.9.14 and **completely deprecates the --chroot functionality**. The pivot_root() logic has been removed, making it impossible to call chroot() during command matching. This security update is non-negotiable.
It is strongly recommended that all system administrators:
sudo installed on their systems immediately.sudo to version 1.9.17p1 or later. This is a top priority for IT security.sudoers configurations to ensure they do not contain problematic rules related to host options or the use of --chroot. Good configuration management is key.These two critical vulnerabilities underscore the importance of keeping system software up-to-date, especially privilege management tools like sudo, which are prime targets for attackers seeking to gain root access on compromised systems. Infrastructure security relies on constant vigilance and swift action.
Mariama
Book a 30-minute conversation to understand how Saturne IA provides technical teams tailored to your growth challenges.
Saturne
ia
