PoC Released for Sudo chroot Flaw Allowing Local Privilege Escalation

On 14 October 2025, a PoC for a critical flaw in the sudo utility was published, enabling any local user to escape a chroot jail and gain root privileges. The vulnerability resides in sudo’s handling of directory paths when invoked with a modified root directory, or chroot, and a specially crafted path can break out of the jail to access the full filesystem and spawn a root shell.

The PoC, described by security researchers and published on GitHub, shows how to trigger the bug by running sudo --chroot with a nested directory name containing escape sequences. The exploit requires only ordinary user privileges, meaning insiders or compromised accounts could potentially elevate privileges.

The advisory also notes that upgrading to fixed versions of sudo mitigates the issue, and suggests auditing sudo configurations and disabling unnecessary chroot operations to reduce exposure; the vulnerability is tracked as CVE-2021-3156, commonly known as Baron Samedit.