CVE-2025-32463

Sudo versions 1.9.14 through 1.9.17

Sudo versions 1.9.14 through 1.9.17 are vulnerable to a local privilege escalation. An attacker can leverage the --chroot option to gain root access by manipulating the /etc/nsswitch.conf file within a user-controlled directory. This allows the attacker to execute arbitrary commands with root privileges. A proof-of-concept (PoC) exploit is publicly available. This vulnerability affects various Linux distributions, including Ubuntu and Fedora. The vulnerability stems from improper handling of the /etc/nsswitch.conf file when using the --chroot option.

Update Sudo to version 1.9.17p1 or later. Rebuild affected base images. Audit for unusual sudoedit usage. Harden privilege boundaries with AppArmor or SELinux.