Millions of Linux and Unix systems have been exposed to serious security risks due to the emergence of two vulnerabilities in Sudo, a fundamental tool that allows users to execute commands with elevated permissions in a controlled manner. These flaws, identified as CVE-2025-32462 y CVE-2025-32463, have been recently analyzed and reported by cybersecurity experts, warning about their impact and the urgency of applying patches.
The discovery has put system administrators and companies on alert, as Sudo is present by default in most GNU/Linux distributions and similar systems, such as macOS. Both bugs allow privilege escalation from accounts without administrative permissions, compromising the integrity of the affected computers.
What is Sudo and why is it so important?
Sudo is an essential utility in Unix environments, used to run administrative tasks without having to log in as rootThis tool provides detailed control over which users can execute certain commands, helping to maintain the principle of least privilege and logging all actions for auditing purposes.
Sudo configuration is managed from the file / Etc / sudoers, allowing you to define specific rules based on user, command, or host, a common practice to strengthen security in large infrastructures.
Technical Details of Sudo Vulnerabilities
CVE-2025-32462: Host option failure
This vulnerability had been hidden in Sudo's code for over a decade., affecting stable versions from 1.9.0 to 1.9.17 and legacy versions from 1.8.8 to 1.8.32. Its origin lies in the option -h o --host, which initially should be limited to listing privileges for other computers However, due to a control failure, it can be used to execute commands or edit files as root on the system itself.
The attack vector leverages specific configurations where Sudo rules are restricted to certain hosts or hostname patterns.. Thus, a local user can trick the system by pretending to execute commands on another authorized host and gain root access. without requiring a complex exploit.
Exploitation of this bug is particularly worrying in enterprise environments, where Host or Host_Alias ​​directives are commonly used to segment access. No additional exploit code is required, just invoke Sudo with the option -h and a host allowed to bypass restrictions.
CVE-2025-32463: Chroot function abuse
In the case of CVE-2025-32463, the severity is greater: A flaw introduced in version 1.9.14 of 2023 in the chroot function allows any local user to execute arbitrary code from paths under their control, gaining administrator privileges.
The attack is based on the manipulation of the Name Service Switch (NSS) system. By running Sudo with the option -R (chroot) and set a directory controlled by the attacker as root, Sudo loads configurations and libraries from this manipulated environment. An attacker can force the loading of a malicious shared library (for example, through /etc/nsswitch.conf (a fake one and a library prepared in the chroot root) to obtain a root shell on the system. The existence of this flaw has been confirmed in several distributions, so it's advisable to stay up-to-date with the latest updates.
The simplicity of this technique has been verified in real-world scenarios, using only a C compiler to create the library and launching the appropriate command with Sudo. No technical sophistication or complicated configurations required.
These two vulnerabilities have been verified in recent versions of Ubuntu, Fedora, and macOS Sequoia, although other distributions may also be affected. For greater protection, it is essential to apply the updates recommended by the developers.
What administrators and users should do
The only effective measure is to update Sudo to version 1.9.17p1 or newer, as in this release the developers have fixed both issues: The host option has been restricted to legitimate use and the chroot function has received changes to its path and library management.Major distributions, such as Ubuntu, Debian, SUSE, and Red Hat, have already released the corresponding patches, and their repositories have secure versions.
Security experts also recommend audit the files /etc/sudoers y /etc/sudoers.d to locate possible uses of the Host or Host_Alias ​​directives, and to check that there are no rules that allow the bug to be exploited.
There are no effective alternative solutions. If you cannot update immediately, it is recommended to closely monitor access and administrative restrictions, although the risk of exposure remains high. To learn more about the measures and recommendations, see this guide on security updates in Linux.
This incident underscores the importance of regular security checks and keeping essential components like Sudo up to date. The existence of hidden flaws for over a decade in such a widespread utility is a stark reminder of the dangers of blindly relying on infrastructure tools without constant review.
The detection of these vulnerabilities in Sudo underscores the importance of proactive patching and auditing strategies. Administrators and organizations should review their systems, apply available patches, and remain vigilant for future issues affecting critical operating system components.
