sudo --chroot Local Root Escalation (CVE-2025-32463)

What to do

Check sudo -V | head -1 and your package version (dpkg -l sudo / rpm -q sudo) against your distro's advisory.
Install the vendor-patched sudo package or upstream 1.9.17p1 or later on every host, including container base images and golden AMIs.
Prioritize shared hosts: bastions, build/CI runners, HPC and lab machines, and servers running internet-facing services under local accounts.
Stop relying on sudo -R/--chroot in scripts; upstream has deprecated it and plans to remove it.
If you use host-restricted sudoers rules (shared sudoers files or LDAP/SSSD), apply the same update to close CVE-2025-32462.

How to check if you are affected or compromised

Search auth logs and auditd for sudo invocations using -R or --chroot, which are rare in normal use.
Look for user-writable directories containing etc/nsswitch.conf and unexpected libnss_*.so files (for example under /tmp or home directories).
Investigate unexpected root shells or new root-owned files created shortly after a non-admin user ran sudo.

What happened#

On June 30, 2025, the sudo project published two advisories, both reported by Rich Mirch of the Stratascale Cyber Research Unit. The serious one is CVE-2025-32463. Starting with sudo 1.9.14, the -R/--chroot option changed root into the directory the user supplied while sudo was still evaluating the sudoers file. A user could put their own etc/nsswitch.conf in that directory and point it at a malicious NSS shared library. Sudo would then load that library as root, and the user had arbitrary code execution as root, whether or not sudoers allowed them anything.

Stratascale's write-up says plainly that "the default Sudo configuration is vulnerable." The user needs no sudo rules at all. It was demonstrated on Ubuntu 24.04 and Fedora 41. The GitHub advisory lists CVSS 3.1 9.3 (AV:L/AC:L/PR:N/UI:N/S:C) and CWE-829.

The companion bug, CVE-2025-32462, is about -h/--host. That option is meant only for listing privileges with -l, but it also took effect when running commands. As a result, host restrictions in sudoers rules could be bypassed. It has existed since sudo 1.8.8. It matters only where rules name specific hosts, which typically means shared sudoers files or LDAP/SSSD setups.

Who is affected#

CVE-2025-32463 affects sudo 1.9.14 through 1.9.17, on systems that use /etc/nsswitch.conf, which covers essentially all mainstream Linux. Sudo 1.8.32 and older lack the chroot feature and are not affected. CVE-2025-32462 affects 1.8.8 through 1.9.17. Both are fixed in sudo 1.9.17p1. The fix reverts the 1.9.14 change and deprecates --chroot. Most distributions shipped patched packages, so trust your vendor's advisory over the bare version number.

Do you really need to act?#

This is a local bug. An attacker first needs a shell as some unprivileged user. Once they have that, the exploit is short, reliable, and works on a default configuration. CISA added CVE-2025-32463 to KEV on September 29, 2025, confirming exploitation in the wild. In the October 21, 2026 KEV snapshot, ransomware use is listed as "Unknown." CVE-2025-32462 is not in KEV.

In practice this is the step that turns a web-app compromise, a leaked low-privilege SSH key or a hostile CI job into root. The fix is now more than a year old. Hosts on routine patching are fine. The ones that slip through are long-lived bastions, CI runners, appliances and container base images that nobody rebuilds. On single-user laptops it adds little to what an attacker already has.

What to do now#

Check sudo -V | head -1 and dpkg -l sudo or rpm -q sudo, and compare against your distro's security notice.
Update to the patched package or 1.9.17p1+, then rebuild base images and AMIs so new hosts don't reintroduce it.
Patch shared hosts first: jump boxes, build runners, HPC and lab machines.
Remove any scripted use of sudo -R, since the option is deprecated.
If you use host-scoped sudoers rules, confirm the same update is everywhere to close CVE-2025-32462.

How to tell if you were hit#

Legitimate use of --chroot is rare, which helps. Search /var/log/auth.log, /var/log/secure, the journal or auditd for sudo invocations with -R or --chroot, especially from users with no sudo rights. On disk, look for user-writable directories that contain etc/nsswitch.conf together with unfamiliar libnss_*.so files. If you find either on a host that was unpatched, treat the host as root-compromised: rebuild it and rotate the credentials it held.

Timeline#

Apr 1, 2025 — Stratascale reports the chroot bug to the sudo maintainer.
Apr 8, 2025 — CVE-2025-32463 and CVE-2025-32462 assigned.
Jun 23, 2025 — Patch shared with the distros list.
Jun 30, 2025 — Public disclosure; sudo 1.9.17p1 released.
Sep 29, 2025 — CISA adds CVE-2025-32463 to KEV.

Vulnerability records

CVE-2025-32463 · KEV 2025-09-29 · Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option.
CVE-2025-32462 · Sudo before 1.9.17p1, when used with a sudoers file that specifies a host that is neither the current host nor ALL, allows listed users to execute commands on…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.