What are the latest Sudo vulnerabilities (CVE-2025-32462 and CVE-2025-32463), and how do they let local users gain root access on Linux?

Sudo, a powerful tool for privilege management on Linux and Unix systems, has been found to contain two serious vulnerabilities that can allow local users to gain unauthorized root access. These flaws, discovered by cybersecurity researcher Rich Mirch and disclosed on July 4, 2025, could affect thousands of systems if left unpatched.

Both vulnerabilities are present in Sudo versions before 1.9.17p1, which is used widely in major Linux distributions like Ubuntu, Red Hat, Debian, and AlmaLinux.

Let’s break down what these flaws are, how they work, and how you can protect your systems.

What is Sudo and Why Is It Important?

Sudo stands for “Superuser Do”, and it allows regular users to execute administrative tasks as another user — usually root. It helps enforce the principle of least privilege in Linux systems.

Sudo’s behavior is controlled by the file /etc/sudoers, which defines:

• Which users can run what commands

• As which other users (like root)

• On which machines

• With or without password prompts

The Two Critical Sudo Vulnerabilities

Let’s examine each vulnerability in more detail.

 CVE-2025-32462 – Host Misconfiguration Vulnerability

• What It Does: Allows users to run commands intended for a different host on the current local machine.

• Root Cause: A bug in the -h (host) flag behavior, present since 2013.

• Who Is Affected: Environments using a shared sudoers file across multiple machines, especially those using LDAP-based sudoers like SSSD.

• Risk Level: Moderate; requires specific configuration.

“This vulnerability has gone unnoticed for more than 12 years,” says Rich Mirch. “It allows misrouted permissions when host rules aren’t properly enforced.”

 CVE-2025-32463 – chroot Misuse Leads to Root Privilege Escalation

• What It Does: Allows any local user to gain root privileges, even without being defined in the sudoers file.

• How It Works: Exploits the --chroot (-R) option by crafting a fake /etc/nsswitch.conf inside a user-controlled directory. This tricks Sudo into loading a malicious shared library.

• Risk Level: High (CVSS 9.3)

• Impact: Default configurations are vulnerable, no sudoer rule is required.

“It’s a serious misbehavior of the chroot feature. Even default sudo setups can be exploited,” warns Mirch.

 How to Fix the Vulnerabilities

The good news? Patches are already available.

• Sudo Version 1.9.17p1 fixes both issues.

• Distributions Issuing Advisories:

  • CVE-2025-32462: AlmaLinux 8 & 9, Alpine Linux, Amazon Linux, Debian, Gentoo, Oracle Linux, Red Hat, SUSE, Ubuntu

  • CVE-2025-32463: Alpine Linux, Amazon Linux, Debian, Gentoo, Red Hat, SUSE, Ubuntu

 Recommended Actions

 Sudo’s Future: chroot Option to Be Removed

The chroot functionality is now considered too risky. Sudo maintainer Todd C. Miller announced that the option will be completely removed in a future release:

“Supporting a user-specified root directory is error-prone and opens up critical risks.”

 Why These Flaws Matter for Cybersecurity

Sudo is installed by default on almost all Linux systems — desktops, servers, and even IoT devices. That makes it a prime target for attackers looking to escalate privileges once inside a machine.

These vulnerabilities show:

• Even mature, trusted tools like Sudo can hide critical bugs.

• A single misconfiguration or overlooked patch can lead to full system compromise.

• Default installations are not always safe — configuration matters.

At a Glance

Conclusion

These vulnerabilities are a clear reminder that local privilege escalation still poses major threats — especially when tools like Sudo are misconfigured or outdated.

If you’re a system administrator, developer, or cybersecurity analyst, take action now:

• Patch Sudo immediately

• Review your sudoers setup

• Avoid using risky features like chroot

Small oversights can have big consequences, and in a world where attackers constantly probe for weak spots, proactive patching is your best defense.