The vulnerability, tracked as CVE-2025-32463, affects Sudo versions 1.9.14 through 1.9.17 and poses a significant threat to Linux systems running default configurations. The vulnerability affects the default Sudo configuration, making it a widespread threat requiring immediate attention. This vulnerability is particularly dangerous because it doesn’t require any Sudo rules to be defined for the attacking user, meaning even users with no administrative privileges can exploit it. This creates a security breach when the Name Service Switch (NSS) operations are triggered, causing the system to load /etc/nsswitch.conf configuration from the untrusted environment. Attackers can specify custom NSS sources that translate to shared object libraries (e.g., libnss_/woot1337.so.2), which Sudo then loads with root privileges. CVE-2025-32463 affects Sudo versions 1.9.14-1.9.17, enabling privilege escalation to root. Impact affects default configurations on Ubuntu, Fedora, and other major Linux distributions. The exploit code shows how a simple gcc -shared -fPIC command can compile the malicious library that gets loaded during Sudo’s NSS operations.
This Cyber News was published on cybersecuritynews.com. Publication date: Tue, 01 Jul 2025 06:25:44 +0000