{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2025-32463", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2025-07-22T14:59:53.402Z", "dateReserved": "2025-04-09T00:00:00.000Z", "datePublished": "2025-06-30T00:00:00.000Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Sudo", "vendor": "Sudo project", "versions": [{"lessThan": "1.9.17p1", "status": "affected", "version": "1.9.14", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-829", "description": "CWE-829 Inclusion of Functionality from Untrusted Control Sphere", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2025-07-22T14:59:53.402Z"}, "references": [{"url": "https://www.sudo.ws/security/advisories/"}, {"url": "https://www.sudo.ws/releases/changelog/"}, {"url": "https://www.stratascale.com/vulnerability-alert-CVE-2025-32463-sudo-chroot"}, {"url": "https://www.openwall.com/lists/oss-security/2025/06/30/3"}, {"url": "https://access.redhat.com/security/cve/cve-2025-32463"}, {"url": "https://ubuntu.com/security/notices/USN-7604-1"}, {"url": "https://security-tracker.debian.org/tracker/CVE-2025-32463"}, {"url": "https://explore.alas.aws.amazon.com/CVE-2025-32463.html"}, {"url": "https://bugs.gentoo.org/show_bug.cgi?id=CVE-2025-32463"}, {"url": "https://www.suse.com/support/update/announcement/2025/suse-su-202502177-1/"}, {"url": "https://www.suse.com/security/cve/CVE-2025-32463.html"}, {"url": "https://www.secpod.com/blog/sudo-lpe-vulnerabilities-resolved-what-you-need-to-know-about-cve-2025-32462-and-cve-2025-32463/"}, {"url": "https://www.sudo.ws/security/advisories/chroot_bug/"}, {"url": "https://www.vicarius.io/vsociety/posts/cve-2025-32463-detect-sudo-vulnerability"}, {"url": "https://www.vicarius.io/vsociety/posts/cve-2025-32463-mitigate-sudo-vulnerability"}], "x_generator": {"engine": "enrichogram 0.0.1"}, "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.3, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"}}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:sudo_project:sudo:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.9.14", "versionEndExcluding": "1.9.17p1"}]}]}]}, "adp": [{"references": [{"url": "https://iototsecnews.jp/2025/07/01/linux-sudo-chroot-vulnerability-enables-hackers-to-elevate-privileges-to-root/", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-07-18T00:00:00+00:00", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2025-32463"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-19T03:55:14.696Z"}}]}, "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-32463", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-07-18T16:19:21.818445Z"}}}], "references": [{"url": "https://iototsecnews.jp/2025/07/01/linux-sudo-chroot-vulnerability-enables-hackers-to-elevate-privileges-to-root/", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-01T13:24:32.317Z"}}], "cna": {"metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.3, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"}}], "affected": [{"vendor": "Sudo project", "product": "Sudo", "versions": [{"status": "affected", "version": "1.9.14", "lessThan": "1.9.17p1", "versionType": "custom"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.sudo.ws/security/advisories/"}, {"url": "https://www.sudo.ws/releases/changelog/"}, {"url": "https://www.stratascale.com/vulnerability-alert-CVE-2025-32463-sudo-chroot"}, {"url": "https://www.openwall.com/lists/oss-security/2025/06/30/3"}, {"url": "https://access.redhat.com/security/cve/cve-2025-32463"}, {"url": "https://ubuntu.com/security/notices/USN-7604-1"}, {"url": "https://security-tracker.debian.org/tracker/CVE-2025-32463"}, {"url": "https://explore.alas.aws.amazon.com/CVE-2025-32463.html"}, {"url": "https://bugs.gentoo.org/show_bug.cgi?id=CVE-2025-32463"}, {"url": "https://www.suse.com/support/update/announcement/2025/suse-su-202502177-1/"}, {"url": "https://www.suse.com/security/cve/CVE-2025-32463.html"}, {"url": "https://www.secpod.com/blog/sudo-lpe-vulnerabilities-resolved-what-you-need-to-know-about-cve-2025-32462-and-cve-2025-32463/"}, {"url": "https://www.sudo.ws/security/advisories/chroot_bug/"}, {"url": "https://www.vicarius.io/vsociety/posts/cve-2025-32463-detect-sudo-vulnerability"}, {"url": "https://www.vicarius.io/vsociety/posts/cve-2025-32463-mitigate-sudo-vulnerability"}], "x_generator": {"engine": "enrichogram 0.0.1"}, "descriptions": [{"lang": "en", "value": "Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-829", "description": "CWE-829 Inclusion of Functionality from Untrusted Control Sphere"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sudo_project:sudo:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.9.17p1", "versionStartIncluding": "1.9.14"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2025-07-22T14:59:53.402Z"}}}, "cveMetadata": {"cveId": "CVE-2025-32463", "state": "PUBLISHED", "dateUpdated": "2025-07-22T14:59:53.402Z", "dateReserved": "2025-04-09T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2025-06-30T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:sudo_project:sudo:*:*:*:*:*:*:*:*", "matchCriteriaId": "91CD68ED-9A18-47B6-91E5-C20D2F69AB65", "versionEndExcluding": "1.9.17", "versionStartIncluding": "1.9.14", "vulnerable": true}, {"criteria": "cpe:2.3:a:sudo_project:sudo:1.9.17:-:*:*:*:*:*:*", "matchCriteriaId": "B563C690-EE9A-437C-9410-54209F82F827", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:canonical:ubuntu_linux:22.04:*:*:*:lts:*:*:*", "matchCriteriaId": "359012F1-2C63-415A-88B8-6726A87830DE", "vulnerable": true}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:24.04:*:*:*:lts:*:*:*", "matchCriteriaId": "BF90B5A4-6E55-4369-B9D4-E7A061E797D2", "vulnerable": true}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:24.10:*:*:*:-:*:*:*", "matchCriteriaId": "418A8B25-A287-4218-A10E-F9345A8E2EB7", "vulnerable": true}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:25.04:*:*:*:-:*:*:*", "matchCriteriaId": "6B40C5AB-76D5-44E1-A571-B9A44522C6BE", "vulnerable": true}, {"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*", "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED", "vulnerable": true}, {"criteria": "cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*", "matchCriteriaId": "46D69DCC-AE4D-4EA5-861C-D60951444C6C", "vulnerable": true}, {"criteria": "cpe:2.3:o:debian:debian_linux:13.0:*:*:*:*:*:*:*", "matchCriteriaId": "204FC6CC-9DAC-45FB-8A9F-C9C8EDD29D54", "vulnerable": true}, {"criteria": "cpe:2.3:o:opensuse:leap:15.6:*:*:*:*:*:*:*", "matchCriteriaId": "78B4F1C7-A301-4C94-A41C-A51182B83677", "vulnerable": true}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*", "matchCriteriaId": "D65C2163-CFC2-4ABB-8F4E-CB09CEBD006C", "vulnerable": true}, {"criteria": "cpe:2.3:o:suse:linux_enterprise_desktop:15:sp6:*:*:*:*:*:*", "matchCriteriaId": "B83183BD-A440-4697-8DD8-8A478C428984", "vulnerable": true}, {"criteria": "cpe:2.3:o:suse:linux_enterprise_desktop:15:sp7:*:*:*:*:*:*", "matchCriteriaId": "B4388826-A383-4FBA-819A-363EAF6183DE", "vulnerable": true}, {"criteria": "cpe:2.3:o:suse:linux_enterprise_real_time:15.0:sp2:*:*:*:*:*:*", "matchCriteriaId": "4B0AC584-5E26-4ACE-BC19-9E69A302F238", "vulnerable": true}, {"criteria": "cpe:2.3:o:suse:linux_enterprise_real_time:15.0:sp6:*:*:*:*:*:*", "matchCriteriaId": "E8772290-7B8F-4FF3-8114-0535E84E10F5", "vulnerable": true}, {"criteria": "cpe:2.3:o:suse:linux_enterprise_real_time:15.0:sp7:*:*:*:*:*:*", "matchCriteriaId": "BF782A24-9E6B-4897-9402-37DBCA7A7332", "vulnerable": true}, {"criteria": "cpe:2.3:o:suse:linux_enterprise_server_for_sap:12:sp6:*:*:*:*:*:*", "matchCriteriaId": "44807632-7775-4496-9217-5F5816943D29", "vulnerable": true}, {"criteria": "cpe:2.3:o:suse:linux_enterprise_server_for_sap:12:sp7:*:*:*:*:*:*", "matchCriteriaId": "2F46E618-B5F5-4CA1-8023-8E9C3E1772A2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option."}, {"lang": "es", "value": "Sudo anterior a 1.9.17p1 permite a los usuarios locales obtener acceso root porque /etc/nsswitch.conf desde un directorio controlado por el usuario se utiliza con la opci\u00f3n --chroot."}], "id": "CVE-2025-32463", "lastModified": "2025-07-22T15:15:26.150", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 6.0, "source": "cve@mitre.org", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2025-06-30T21:15:30.257", "references": [{"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/security/cve/cve-2025-32463"}, {"source": "cve@mitre.org", "tags": ["Issue Tracking", "Third Party Advisory"], "url": "https://bugs.gentoo.org/show_bug.cgi?id=CVE-2025-32463"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://explore.alas.aws.amazon.com/CVE-2025-32463.html"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://security-tracker.debian.org/tracker/CVE-2025-32463"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://ubuntu.com/security/notices/USN-7604-1"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://www.openwall.com/lists/oss-security/2025/06/30/3"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://www.secpod.com/blog/sudo-lpe-vulnerabilities-resolved-what-you-need-to-know-about-cve-2025-32462-and-cve-2025-32463/"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://www.stratascale.com/vulnerability-alert-CVE-2025-32463-sudo-chroot"}, {"source": "cve@mitre.org", "tags": ["Release Notes"], "url": "https://www.sudo.ws/releases/changelog/"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "https://www.sudo.ws/security/advisories/"}, {"source": "cve@mitre.org", "url": "https://www.sudo.ws/security/advisories/chroot_bug/"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://www.suse.com/security/cve/CVE-2025-32463.html"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://www.suse.com/support/update/announcement/2025/suse-su-202502177-1/"}, {"source": "cve@mitre.org", "url": "https://www.vicarius.io/vsociety/posts/cve-2025-32463-detect-sudo-vulnerability"}, {"source": "cve@mitre.org", "url": "https://www.vicarius.io/vsociety/posts/cve-2025-32463-mitigate-sudo-vulnerability"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://iototsecnews.jp/2025/07/01/linux-sudo-chroot-vulnerability-enables-hackers-to-elevate-privileges-to-root/"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-829"}], "source": "cve@mitre.org", "type": "Secondary"}]}

{"bugzilla": {"description": "sudo: LPE via chroot option", "id": "2374693", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2374693"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.8", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-427", "details": ["Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option.", "A flaw was found in Sudo. This flaw allows a local attacker to escalate their privileges by tricking Sudo into loading an arbitrary shared library using the user-specified root directory via the `-R` (`--chroot`) option. An attacker can run arbitrary commands as root on systems that support `/etc/nsswitch.conf`."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2025-32463", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "sudo", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "sudo", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "sudo", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "sudo", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "sudo", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "rhcos", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2025-06-30T14:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-32463\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-32463\nhttps://www.stratascale.com/vulnerability-alert-CVE-2025-32463-sudo-chroot\nhttps://www.sudo.ws/security/advisories/chroot_bug/"], "statement": "The severity of this vulnerability is rated as Important due to the requirement that an attacker must have access to a valid account on a system and that it allows a local unprivileged attacker to escalate their privileges even if the account is not listed in the sudoers file.\nDue to the limited range of vulnerable versions, this vulnerability does not affect RHEL-9 or any earlier versions of RHEL. Due to this, Openshift is also not affected by this vulnerability.", "threat_severity": "Important"}