---
title: "sudo --chroot Local Root Escalation (CVE-2025-32463)"
url: https://erroneo.us/security/briefs/sudo-chroot-privilege-escalation-cve-2025-32463/
description: "sudo 1.9.14-1.9.17 let any local user get root via -R and a fake nsswitch.conf. Fixed in 1.9.17p1; in CISA KEV. Verdict: check exposure."
type: security-brief
section: "Security Digest"
date_published: 2025-06-30
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2025-32463", "CVE-2025-32462"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# sudo --chroot Local Root Escalation (CVE-2025-32463)

**Verdict: Check exposure.** Distros patched this in mid-2025 and it is now known-exploited; any multi-user or shared Linux host still on sudo 1.9.14-1.9.17 without the vendor fix hands root to every local account.

- **Who must act:** Admins of Linux hosts where untrusted or semi-trusted users, compromised services or CI jobs can get a local shell, if sudo is 1.9.14 through 1.9.17 without the distro patch.
- **Who can relax:** Single-user machines, hosts on sudo 1.9.17p1 or a vendor-patched build, and systems with sudo 1.8.32 or older (no chroot feature); CVE-2025-32462 matters only with host-restricted sudoers rules.
- **Affected:** sudo 1.9.14 through 1.9.17 (CVE-2025-32463); sudo 1.8.8 through 1.9.17 (CVE-2025-32462)
- **Fixed:** sudo 1.9.17p1; Distribution backports (check your vendor advisory)
- **CVEs:** CVE-2025-32463, CVE-2025-32462
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Check sudo -V | head -1 and your package version (dpkg -l sudo / rpm -q sudo) against your distro's advisory.
2. Install the vendor-patched sudo package or upstream 1.9.17p1 or later on every host, including container base images and golden AMIs.
3. Prioritize shared hosts: bastions, build/CI runners, HPC and lab machines, and servers running internet-facing services under local accounts.
4. Stop relying on sudo -R/--chroot in scripts; upstream has deprecated it and plans to remove it.
5. If you use host-restricted sudoers rules (shared sudoers files or LDAP/SSSD), apply the same update to close CVE-2025-32462.

### How to check if you are affected

- Search auth logs and auditd for sudo invocations using -R or --chroot, which are rare in normal use.
- Look for user-writable directories containing etc/nsswitch.conf and unexpected libnss_*.so files (for example under /tmp or home directories).
- Investigate unexpected root shells or new root-owned files created shortly after a non-admin user ran sudo.

## What happened

On June 30, 2025, the sudo project published two advisories, both reported by Rich Mirch of the Stratascale Cyber Research Unit. The serious one is [CVE-2025-32463](https://www.sudo.ws/security/advisories/chroot_bug/). Starting with sudo 1.9.14, the `-R`/`--chroot` option changed root into the directory the user supplied *while sudo was still evaluating the sudoers file*. A user could put their own `etc/nsswitch.conf` in that directory and point it at a malicious NSS shared library. Sudo would then load that library as root, and the user had arbitrary code execution as root, whether or not sudoers allowed them anything.

[Stratascale's write-up](https://www.stratascale.com/resource/cve-2025-32463-sudo-chroot-elevation-of-privilege/) says plainly that "the default Sudo configuration is vulnerable." The user needs no sudo rules at all. It was demonstrated on Ubuntu 24.04 and Fedora 41. The [GitHub advisory](https://github.com/advisories/GHSA-695j-c63m-mvxc) lists CVSS 3.1 9.3 (`AV:L/AC:L/PR:N/UI:N/S:C`) and CWE-829.

The companion bug, [CVE-2025-32462](https://www.sudo.ws/security/advisories/host_any/), is about `-h`/`--host`. That option is meant only for listing privileges with `-l`, but it also took effect when running commands. As a result, host restrictions in sudoers rules could be bypassed. It has existed since sudo 1.8.8. It matters only where rules name specific hosts, which typically means shared sudoers files or LDAP/SSSD setups.

## Who is affected

CVE-2025-32463 affects sudo 1.9.14 through 1.9.17, on systems that use `/etc/nsswitch.conf`, which covers essentially all mainstream Linux. Sudo 1.8.32 and older lack the chroot feature and are not affected. CVE-2025-32462 affects 1.8.8 through 1.9.17. Both are fixed in sudo 1.9.17p1. The fix reverts the 1.9.14 change and deprecates `--chroot`. Most distributions shipped patched packages, so trust your vendor's advisory over the bare version number.

## Do you really need to act?

This is a local bug. An attacker first needs a shell as some unprivileged user. Once they have that, the exploit is short, reliable, and works on a default configuration. [CISA added CVE-2025-32463 to KEV](https://www.cisa.gov/news-events/alerts/2025/09/29/cisa-adds-five-known-exploited-vulnerabilities-catalog) on September 29, 2025, confirming exploitation in the wild. In the October 21, 2026 KEV snapshot, ransomware use is listed as "Unknown." CVE-2025-32462 is not in KEV.

In practice this is the step that turns a web-app compromise, a leaked low-privilege SSH key or a hostile CI job into root. The fix is now more than a year old. Hosts on routine patching are fine. The ones that slip through are long-lived bastions, CI runners, appliances and container base images that nobody rebuilds. On single-user laptops it adds little to what an attacker already has.

## What to do now

1. Check `sudo -V | head -1` and `dpkg -l sudo` or `rpm -q sudo`, and compare against your distro's security notice.
2. Update to the patched package or 1.9.17p1+, then rebuild base images and AMIs so new hosts don't reintroduce it.
3. Patch shared hosts first: jump boxes, build runners, HPC and lab machines.
4. Remove any scripted use of `sudo -R`, since the option is deprecated.
5. If you use host-scoped sudoers rules, confirm the same update is everywhere to close CVE-2025-32462.

## How to tell if you were hit

Legitimate use of `--chroot` is rare, which helps. Search `/var/log/auth.log`, `/var/log/secure`, the journal or auditd for sudo invocations with `-R` or `--chroot`, especially from users with no sudo rights. On disk, look for user-writable directories that contain `etc/nsswitch.conf` together with unfamiliar `libnss_*.so` files. If you find either on a host that was unpatched, treat the host as root-compromised: rebuild it and rotate the credentials it held.

## Timeline

- Apr 1, 2025 — Stratascale reports the chroot bug to the sudo maintainer.
- Apr 8, 2025 — CVE-2025-32463 and CVE-2025-32462 assigned.
- Jun 23, 2025 — Patch shared with the distros list.
- Jun 30, 2025 — Public disclosure; sudo 1.9.17p1 released.
- Sep 29, 2025 — CISA adds CVE-2025-32463 to KEV.

## Sources

1. [sudo project — Local Privilege Escalation via chroot option (CVE-2025-32463)](https://www.sudo.ws/security/advisories/chroot_bug/)
2. [sudo project — Local Privilege Escalation via host option (CVE-2025-32462)](https://www.sudo.ws/security/advisories/host_any/)
3. [Stratascale — CVE-2025-32463: Sudo chroot elevation of privilege](https://www.stratascale.com/resource/cve-2025-32463-sudo-chroot-elevation-of-privilege/)
4. [GitHub Advisory — CVE-2025-32463 (GHSA-695j-c63m-mvxc)](https://github.com/advisories/GHSA-695j-c63m-mvxc)
5. [CISA — CISA Adds Five Known Exploited Vulnerabilities to Catalog (Sep 29, 2025)](https://www.cisa.gov/news-events/alerts/2025/09/29/cisa-adds-five-known-exploited-vulnerabilities-catalog)

---
Source page: https://erroneo.us/security/briefs/sudo-chroot-privilege-escalation-cve-2025-32463/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt