Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf…
Priority CRITICAL 99Exploited in the wildCWE-829Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-829.
Summary
Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option.
Why it matters now
Exploitation Active In CISA KEV since 2025-09-29CISA due date 2025-10-20
EPSS 0.563 99th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed Sudo (Sudo project): 1.9.17p1Red Hat: 1 advisory
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Active
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Sudo project | Sudo | 1.9.14 to before 1.9.17p1 | 1.9.17p1 | Patch available | CNA |
- Sudo VendorSudo project Affected 1.9.14 to before 1.9.17p1 Fixed in 1.9.17p1 Patch available CNA
CPE configurations NVD · 18
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:sudo_project:sudo:*:*:*:*:*:*:*:* | 1.9.14 to before 1.9.17 | Vulnerable | Sudo project |
| cpe:2.3:a:sudo_project:sudo:1.9.17:-:*:*:*:*:*:* | 1.9.17 | Vulnerable | Sudo project |
| cpe:2.3:o:canonical:ubuntu_linux:22.04:*:*:*:lts:*:*:* | 22.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:24.04:*:*:*:lts:*:*:* | 24.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:24.10:*:*:*:-:*:*:* | 24.10 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:25.04:*:*:*:-:*:*:* | 25.04 | Vulnerable | Canonical |
| cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* | 11.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:* | 12.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:13.0:*:*:*:*:*:*:* | 13.0 | Vulnerable | Debian |
| cpe:2.3:o:opensuse:leap:15.6:*:*:*:*:*:*:* | 15.6 | Vulnerable | openSUSE |
- cpe:2.3:a:sudo_project:sudo:*:*:*:*:*:*:*:* Versions 1.9.14 to before 1.9.17 Vulnerable ·Sudo project
- cpe:2.3:a:sudo_project:sudo:1.9.17:-:*:*:*:*:*:* Versions 1.9.17 Vulnerable ·Sudo project
- cpe:2.3:o:canonical:ubuntu_linux:22.04:*:*:*:lts:*:*:* Versions 22.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:24.04:*:*:*:lts:*:*:* Versions 24.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:24.10:*:*:*:-:*:*:* Versions 24.10 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:25.04:*:*:*:-:*:*:* Versions 25.04 Vulnerable ·Canonical
- cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:* Versions 12.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:13.0:*:*:*:*:*:*:* Versions 13.0 Vulnerable ·Debian
- cpe:2.3:o:opensuse:leap:15.6:*:*:*:*:*:*:* Versions 15.6 Vulnerable ·openSUSE
Show 8 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Red Hat |
| cpe:2.3:o:suse:linux_enterprise_desktop:15:sp6:*:*:*:*:*:* | 15 sp6 | Vulnerable | SUSE |
| cpe:2.3:o:suse:linux_enterprise_desktop:15:sp7:*:*:*:*:*:* | 15 sp7 | Vulnerable | SUSE |
| cpe:2.3:o:suse:linux_enterprise_real_time:15.0:sp2:*:*:*:*:*:* | 15.0 sp2 | Vulnerable | SUSE |
| cpe:2.3:o:suse:linux_enterprise_real_time:15.0:sp6:*:*:*:*:*:* | 15.0 sp6 | Vulnerable | SUSE |
| cpe:2.3:o:suse:linux_enterprise_real_time:15.0:sp7:*:*:*:*:*:* | 15.0 sp7 | Vulnerable | SUSE |
| cpe:2.3:o:suse:linux_enterprise_server_for_sap:12:sp6:*:*:*:*:*:* | 12 sp6 | Vulnerable | SUSE |
| cpe:2.3:o:suse:linux_enterprise_server_for_sap:12:sp7:*:*:*:*:*:* | 12 sp7 | Vulnerable | SUSE |
- cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Red Hat
- cpe:2.3:o:suse:linux_enterprise_desktop:15:sp6:*:*:*:*:*:* Versions 15 sp6 Vulnerable ·SUSE
- cpe:2.3:o:suse:linux_enterprise_desktop:15:sp7:*:*:*:*:*:* Versions 15 sp7 Vulnerable ·SUSE
- cpe:2.3:o:suse:linux_enterprise_real_time:15.0:sp2:*:*:*:*:*:* Versions 15.0 sp2 Vulnerable ·SUSE
- cpe:2.3:o:suse:linux_enterprise_real_time:15.0:sp6:*:*:*:*:*:* Versions 15.0 sp6 Vulnerable ·SUSE
- cpe:2.3:o:suse:linux_enterprise_real_time:15.0:sp7:*:*:*:*:*:* Versions 15.0 sp7 Vulnerable ·SUSE
- cpe:2.3:o:suse:linux_enterprise_server_for_sap:12:sp6:*:*:*:*:*:* Versions 12 sp6 Vulnerable ·SUSE
- cpe:2.3:o:suse:linux_enterprise_server_for_sap:12:sp7:*:*:*:*:*:* Versions 12 sp7 Vulnerable ·SUSE
Remediation
- Fix · CNA Sudo (Sudo project) Fixed in 1.9.17p1
Red Hat 1 advisory
- RHSA-2025:11537 Released 2025-07-22 · Red Hat rating Importantsudo security update
- Red Hat Enterprise Linux AppStream (v. 10) sudo-python-plugin-1.9.15-8.p5.el10_0.2
- Red Hat Enterprise Linux BaseOS (v. 10) sudo-1.9.15-8.p5.el10_0.2
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Sudo 1.9.17p1
2 records Highest priority Priority CRITICAL 1 CRITICAL, 1 MEDIUM
Other records, highest priority first
- TI-2025-23529 Incorrect authorization in SudoPriority MEDIUM 45
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux AppStream (v. 10) | Fixed | RHSA-2025:11537 |
| Red Hat Enterprise Linux BaseOS (v. 10) | Fixed | RHSA-2025:11537 |
Not affected: 5 products
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat OpenShift Container Platform 4
Timeline
- 2025-09-29 Added to CISA KEV
- 2026-10-02 Threatist record created from CVE-2025-32463
- 2026-10-03 Alias added: GHSA-695j-c63m-mvxc
References
Exploit 2
Advisory 13
- https://www.sudo.ws/security/advisories/
- https://www.openwall.com/lists/oss-security/2025/06/30/3
- https://access.redhat.com/security/cve/cve-2025-32463
- https://ubuntu.com/security/notices/USN-7604-1
- https://security-tracker.debian.org/tracker/CVE-2025-32463
- https://explore.alas.aws.amazon.com/CVE-2025-32463.html
- https://bugs.gentoo.org/show_bug.cgi?id=CVE-2025-32463
- https://www.suse.com/support/update/announcement/2025/suse-su-202502177-1/
- https://www.suse.com/security/cve/CVE-2025-32463.html
- https://www.sudo.ws/security/advisories/chroot_bug/
- https://www.vicarius.io/vsociety/posts/cve-2025-32463-detect-sudo-vulnerability
- https://www.vicarius.io/vsociety/posts/cve-2025-32463-mitigate-sudo-vulnerability
- https://iototsecnews.jp/2025/07/01/linux-sudo-chroot-vulnerability-enables-hackers-to-elevate-privileges-to-root/
More Sudo project Sudo vulnerabilities
- TI-2021-02242 Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer… KEVCVSS 3.1HIGH 7.8
- TI-2019-10640 In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass… CVSS 3.1HIGH 8.8
- TI-2023-08978 In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed… CVSS 3.1HIGH 7.8
- TI-2019-13477 In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a… CVSS 3.1HIGH 7.8
- TI-2025-23529 Incorrect authorization in Sudo CVSS 3.1HIGH 8.8
- TI-2023-06485 Sudo: improper handling of ipa_hostname leads to privilege mismanagement CVSS 3.1HIGH 8.8
Sources
- CVE-2025-32463 · CVE Program
- CVE-2025-32463 · NVD
- CISA Known Exploited Vulnerabilities
- FIRST EPSS
- GHSA-695j-c63m-mvxc · GitHub Advisory Database · CC BY 4.0
- CVE-2025-32463 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences