Researchers Publish Technical Analysis of Linux Sudo Privilege Escalation

A team of security researchers has released an in-depth technical report on CVE-2025-32463, a critical local privilege escalation flaw in the Linux sudo utility. The vulnerability affects sudo versions 1.9.14 through 1.9.17 and can allow a local attacker with standard sudo access to gain full root privileges by abusing the tool’s –chroot feature.

The flaw stems from a logic error in the –chroot (or -R) option, where sudo applies confinement before checking permissions and loading NSS modules, enabling a rogue shared library to execute with root privileges via NSS’s dynamic module loading. A number of steps are outlined for exploitation, including creating a malicious /etc/nsswitch.conf inside a chroot, compiling a malicious library, and triggering the sequence with sudo -R /tmp/my_chroot /usr/bin/id to spawn a root shell.

Affected systems include Ubuntu 24.04+, Red Hat 8/9, SUSE, Amazon Linux, and macOS Ventura/Sonoma when using vulnerable sudo releases, with the issue posing particular danger in containerised environments. Defences urged include upgrading to sudo 1.9.17p1 or later, disabling chroot in sudoers via Defaults !chroot in visudo, mounting /tmp with noexec,nosuid,nodev, and applying MAC policies to restrict NSS module loading.