Critical Sudo Vulnerability Alert Local Root Escalation

A critical vulnerability, CVE-2025-32463, has been identified in Sudo, a fundamental command in Linux and macOS environments used for managing administrative privileges. The Cybersecurity and Infrastructure Security Agency (CISA) has issued an alert regarding active exploitation of this flaw, which allows unprivileged local attackers to escalate their privileges to root. Patches are available, and the vulnerability has been added to CISA's Known Exploited Vulnerabilities (KEV) catalogue.

The vulnerability affects Sudo versions 1.9.14 and later. It introduces a flaw that enables users without administrative rights to execute commands with root privileges, even if they are not listed in the sudoers file. This is achieved by manipulating the /etc/nsswitch.conf file in conjunction with the chroot parameter of Sudo. An attacker can create a controlled nsswitch.conf file, use chroot to deceive Sudo, and ultimately gain privileged execution. The vulnerability was addressed in version 1.9.17p1 by removing the compromised options.

The primary risk associated with CVE-2025-32463 is the potential for any local attacker to gain complete control over the system. This can lead to severe security breaches, including data theft, malware installation, and persistent access for future attacks. The existence of a public Proof of Concept (PoC) and circulating exploits significantly increases the threat level for critical infrastructure, business deployments, and individual users alike. Immediate action is crucial to mitigate these risks.

It is strongly recommended to update Sudo to version 1.9.17p1 or later as soon as possible. Reviewing CISA's KEV catalogue and implementing the suggested configuration improvements is also essential. These improvements involve restricting system access and monitoring for suspicious activity. Disabling unnecessary functionalities and conducting audits of security configurations prior to the patch are also advised. Swift patch application and continuous monitoring are critical to prevent the exploitation of CVE-2025-32463.

IT teams should prioritise updating Sudo and consult official sources, such as CISA's KEV and NIST, to assess current and future risks. Effective prevention reduces the attack surface and strengthens organisational resilience. The vulnerability poses a significant threat to the security and integrity of affected servers and workstations worldwide, demanding prompt and decisive action.

Fuente Original: https://unaaldia.hispasec.com/2025/09/cisa-alerta-vulnerabilidad-critica-en-sudo-permite-escalada-local-a-root.html?utm_source=rss&utm_medium=rss&utm_campaign=cisa-alerta-vulnerabilidad-critica-en-sudo-permite-escalada-local-a-root

Artículos relacionados de LaRebelión:

• Argo CD API Exposes Repository Credentials Vulnerability Alert
• FBI Warns Russian Hackers Targeting US Critical Infrastructure - Cisco Vulnerability Exploited

Artículo generado mediante LaRebelionBOT