CVE-2025-32463 PoC — Sudo 安全漏洞

Description

Linux distributions: Affects Ubuntu, Debian, Fedora, CentOS, SUSE, Amazon Linux, and others shipping sudo v1.9.14–1.9.17

Readme

Yes, **CVE‑2025‑32463** is a *critical* local privilege escalation vulnerability in the widely used `sudo` utility. Here's what you need to know:

---

### 🔒 What is the risk?

* The flaw exists in `sudo` versions **1.9.14 through 1.9.17** and stems from misuse of the `--chroot` (or `-R`) option. Attackers can place a malicious `/etc/nsswitch.conf` and library in a chroot directory, causing `sudo` to load arbitrary code and grant **full root privileges** to a local user—even if they aren't listed in the sudoers file ([nvd.nist.gov][1], [helpnetsecurity.com][2]).
* The CVSS 3.1 score is **9.3/10 (Critical)**—high integrity, confidentiality, and availability impacts ([nvd.nist.gov][1]).
* Real-world exploits exist: public proof-of-concept code allows unprivileged users to get a root shell in seconds ([redhotcyber.com][3]).

---

### ✅ Who's affected?

* **Linux distributions**: Affects Ubuntu, Debian, Fedora, CentOS, SUSE, Amazon Linux, and others shipping `sudo` v1.9.14–1.9.17 ([thehackernews.com][4]).
* **macOS (Sequoia)**: Reported to also be vulnerable ([helpnetsecurity.com][2]).

---

### 🛡 What should you do?

1. **Check your `sudo` version**:

   ```bash
   sudo --version
   ```

2. **If you’re on v1.9.14 to v1.9.17**, *immediately* upgrade to **v1.9.17p1 or later**, where the vulnerability is fixed ([helpnetsecurity.com][2]).

3. **Apply OS vendor patches**:

   * Ubuntu released hotfixes promptly ([ubuntu.com][5]).
   * SUSE, Debian, Red Hat, Amazon Linux, and others have also issued advisories and updates .

---

### Summary

* **Severity**: Extremely high—*any* local user can gain root.
* **Exploitation**: Simple, with working exploits in the wild.
* **Fix**: Upgrade to `sudo` v1.9.17p1 or later **now**, and apply distro patches.
* **Mitigation**: Remove or restrict `sudo`’s `--chroot` feature where possible, and use additional controls (e.g., SELinux, AppArmor) as defense-in-depth ([wiz.io][6], [github.com][7]).

---

### ✅ Bottom line:

If you run a vulnerable version of `sudo`, this is a **very serious vulnerability**. Patch immediately to prevent complete system compromise by local attackers. Let me know if you need help identifying or patching on your specific distro!

[1]: https://nvd.nist.gov/vuln/detail/CVE-2025-32463?utm_source=chatgpt.com "CVE-2025-32463 Detail - NVD"
[2]: https://www.helpnetsecurity.com/2025/07/01/sudo-local-privilege-escalation-vulnerabilities-fixed-cve-2025-32462-cve-2025-32463/?utm_source=chatgpt.com "Sudo local privilege escalation vulnerabilities fixed (CVE-2025-32462, CVE-2025-32463)"
[3]: https://www.redhotcyber.com/en/post/linux-pwned-privilege-escalation-on-sudo-in-5-seconds-hackerhood-tests-the-cve-2025-32463-exploit/?utm_source=chatgpt.com "Linux Pwned! Privilege Escalation on SUDO in 5 ... - Red Hot Cyber"
[4]: https://thehackernews.com/2025/07/critical-sudo-vulnerabilities-let-local.html?utm_source=chatgpt.com "Critical Sudo Vulnerabilities Let Local Users Gain Root Access on Linux, Impacting Major Distros"
[5]: https://ubuntu.com/security/CVE-2025-32463?utm_source=chatgpt.com "CVE-2025-32463 - Ubuntu"
[6]: https://www.wiz.io/vulnerability-database/cve/cve-2025-32463?utm_source=chatgpt.com "CVE-2025-32463 Impact, Exploitability, and Mitigation Steps | Wiz"
[7]: https://github.com/kh4sh3i/CVE-2025-32463?utm_source=chatgpt.com "kh4sh3i/CVE-2025-32463: Local Privilege Escalation to ... - GitHub"

File Snapshot

Remarks