This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] Sudo fixes 2 critical vulnerabilities

Sudo fixes 2 critical vulnerabilities in version 1.9.17p1 [1][2]. Only some Red Hat products are affected by these vulnerabilities, and fixes have already been released for some of them. Details can be found at [3][4]. Debian releases are affected only by the vulnerability CVE-2025-32462 [5][6]. Individual Debian and Ubuntu releases and their fixed versions: Debian [5][6]: bullseye (security) - 1.9.5p2-3+deb11u2 bookworm (security) - 1.9.13p3-1+deb12u2 trixie, sid - 1.9.16p2-3 Ubuntu [7][8]: plucky - 1.9.16p2-1ubuntu1.1 oracular - 1.9.15p5-3ubuntu5.24.10.1 noble - 1.9.15p5-3ubuntu5.24.04.1 jammy - 1.9.9-1ubuntu2.5 focal - 1.8.31-1ubuntu1.5+esm1 bionic - 1.8.21p2-3ubuntu1.6+esm1 xenial - 1.8.16-0ubuntu1.10+esm3 trusty - 1.8.9p5-1ubuntu1.5+esm8

Sudo - privilege escalation (CVE-2025-32463)
CVSS 9.3 (Critical)

An unauthenticated local attacker can execute arbitrary commands with root privileges. The vulnerability is exploitable only if the sudo option "--chroot" ("-R") can be used on the system [9][2]. Whether a system is vulnerable can be verified with the command "sudo grep -r "CHROOT=" /etc/sudoers /etc/sudoers.d/". If the command returns non-empty output and sudo is in a vulnerable version, the system is vulnerable.

The vulnerability is present in product:

  • Sudo; >=1.9.14, <1.9.17p1;

CVSS: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 30. 6. 2025.

Sudo - privilege escalation (CVE-2025-32462)
CVSS 9.3 (Critical)

An unauthenticated local attacker can execute commands with root privileges by running the sudo command with the "--host" ("-h") option. The vulnerability is exploitable only if the sudoers file contains different permissions for different hosts [1].

The vulnerability is present in product:

  • Sudo; >=1.8.8, <1.9.17p1;

CVSS: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 30. 6. 2025.

By CESNET, z.s.p.o. Martin Krajči on 3. 7. 2025.

CESNET, z.s.p.o. Logo