Linux sudo vulnerability allows root access without password

A critical security vulnerability, designated CVE-2025-32463, has been identified in the widely used Linux utility sudo. Discovered in June 2025, the flaw carries a CVSS score of 9.3, indicating a severe risk. It allows attackers with local access to escalate their privileges to root without needing to provide a password.

The vulnerability stems from an issue in how sudo handles the --chroot option. When this option is used, a manipulated name service switch configuration file (nsswitch.conf) can trick sudo into loading and executing a malicious shared library from an attacker-controlled environment with root privileges. This effectively grants the attacker full control over the system.

While the exploit requires an attacker to already have some level of access to the target system, its impact is significant. In multi-user environments, containers, or shared development servers, a single compromised account can lead to a complete system takeover. The vulnerability bypasses password prompts entirely, making it a swift method for privilege escalation.

A proof-of-concept exploit for CVE-2025-32463 has been made publicly available on GitHub, demonstrating the exploit's mechanism. This highlights the urgent need for systems to be patched. Organizations can use tools like the Enginsight SIEM to audit their systems for susceptibility to this vulnerability or to detect ongoing exploit attempts.