{"id":138584,"date":"2025-07-01T17:11:57","date_gmt":"2025-07-01T15:11:57","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-utilite-sudo-pozvolyayushhie-poluchit-prava-root-v-sisteme"},"modified":"2025-07-01T17:11:57","modified_gmt":"2025-07-01T15:11:57","slug":"uyazvimosti-v-utilite-sudo-pozvolyayushhie-poluchit-prava-root-v-sisteme","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimosti-v-utilite-sudo-pozvolyayushhie-poluchit-prava-root-v-sisteme","title":{"rendered":"Vulnerabilities in the sudo utility allow obtaining root privileges in the system.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
A vulnerability has been discovered in the sudo package, used to execute commands as different users (CVE-2025-32463), allowing any unprivileged user to execute code with root privileges, even if the user is not mentioned in the sudoers configuration. The issue affects distributions using the configuration file \/etc\/nsswitch.conf; for instance, the exploitability of the vulnerability has been demonstrated in Ubuntu 24.04 and Fedora 41. <\/p>\n
The vulnerability appears in the default configuration and has been confirmed in sudo releases from 1.9.14 to 1.9.17 (potentially affecting all versions starting from 1.8.33). The issue has been fixed in the sudo update 1.9.17p1. You can check the status of the new package version or the preparation of a patch in the following distributions (if the page is unavailable, it means the distribution developers have not yet started addressing the issue): Debian, Ubuntu, Fedora, SUSE\/openSUSE, RHEL, Gentoo, and Arch (1, 2). <\/p>\n
The issue arises because when using the option «-R» («—chroot») to run commands in a chroot environment with a selected root directory by the user, the file \/etc\/nsswitch.conf was loaded in the context of the new root directory instead of the system directory. Since a user can use their own directory as the root for chroot, they may place the nsswitch.conf configuration file there. By controlling the file \/etc\/nsswitch.conf loaded by the NSS (Name Service Switch) subsystem, a user can add settings that lead to the invocation of additional handlers. Such handlers are loaded by NSS in the form of shared libraries, which can also be placed in a user-controlled directory. By substituting their own library, the user can execute code from it with root privileges, as NSS processing occurs before privilege dropping. <\/p>\n
In version sudo 1.9.17p1, another vulnerability (CVE-2025-32462) was also fixed, allowing commands to be executed with root privileges but only manifesting in sudoers configurations where the «host» parameter is set to a value other than ALL or the name of the current host. The vulnerability is caused by a bug that made the option «-h» («—host») work not only in conjunction with the «-l» («—list») option for listing host-bound privileges but also when executing commands. Thus, a user could specify any host when invoking sudo and bypass the restrictions of sudoers rules tied to the hostname. <\/p>\n
To carry out the attack, the user must be mentioned in sudoers; for example, if the settings specify «testuser testhost = ALL», the user «testuser» could specify «sudo -h testhost» and execute commands with root privileges on any host, not just on the host testhost. Configurations with settings like «testuser ALL = ALL» or without explicit rules for a specific user are not vulnerable. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"