CVE-2025-32463

When Sudo is run with the --chroot option, the program loads the /etc/nsswitch.conf configuration file from the specified chroot directory, which can be controlled by a local user. An attacker can prepare a crafted nsswitch.conf file in their directory, causing a malicious library to be loaded or changing the behavior of name resolution mechanisms (NSS). This results in execution of unauthorized code with root privileges in the context of the Sudo process (CWE-829: Inclusion of Functionality from Untrusted Control Sphere).

An attacker with local access to the system can obtain full root privileges, enabling system takeover, reading and modifying any files, as well as further offensive actions on the network.

The Sudo package must be updated to version 1.9.17p1 or later. For individual distributions, patches available from the vendor should be applied according to references (Red Hat, Debian, Ubuntu USN-7604-1, openSUSE, Amazon Linux).

Sudo prior to version 1.9.17p1 on systems such as SUSE Linux Enterprise Server for SAP, Red Hat Enterprise Linux, Debian Linux, openSUSE Leap, and Canonical Ubuntu Linux.

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Sudo contains an inclusion of functionality from untrusted control sphere vulnerability. This vulnerability could allow local attacker to leverage sudo’s -R (--chroot) option to run arbitrary commands as root, even if they are not listed in the sudoers file.